Can you be certain that nobody has retained a copy of this key?

Can’t be certain that no one has copied the unencrypted user’s data either.

I don't know if this addresses the underlying issue.

I was about to suggest the exact same. It is literally what we do at my company. Of course you now have to them deal with searching and indexing. To mitigate this issue, we use UUIDs to reference users throughout our systems. Any fields that would link that UUID back to a real person or contain personal info is then kept encrypted. That way, we can still gather all the information from our various components but if we needed to, we can essentially make the user data unreabable.

Doesn't this still leak information? "A person known by these 5 people was in contact with the suicide hotline."

Doesn't this leave you with a bunch of junk data taking up space?

What's the problem with actually just deleting this data when you're done with it though?

Because FKs on a relational model.. as an example, deleting a user/account might end up being a task on going through every reference to it, and the references to its references, etc.

This is actually the reason some companies do not delete users/accounts [0].

[0] https://news.ycombinator.com/item?id=23005060

One of our popular accounts has about 70M worth of rows. I can't imagine how we would go about deleting their data. We rotate out old data each month when it doesn't become needed, but maybe 40M records (4M new each month gets added).

Not all customers are cool with this approach.

For regulatory reasons or because of "you didn't really delete it"? This is similar to deleting a file but not overwriting the space it occupied on the disk, isn't it? The data is still "there", but it's not accessible by normal means.

Is that okay from a GDPR perspective? What if there's an exploit discovered in the implementation of the encryption? Or what if quantum computers can crack it easily in the future?

It is ok for GDPR, it is axon uses it in their commercial GDPR modul (better then our but same principale).

Broken encryption, 20 years better machines in future and quantum are solved with same trick. We have event sourcing.

Implement best current encryption, delete everything except event store, decrypt events with old encryption publish events and everything in now encrypted with best current encryption events in new store. Delete deprecated old event store. Skip aggregates with deleted old key.