Yeah, for GDPR compliance when you're using Kafka, the key is to use, well keys, and log compaction.

Then you can retrieve PII for a GDPR if needed.

Or, remove it entirely by submitting a "tombstone" record with key -> null, then log compaction removes it.

Which basically means, don't mix PII into transnational data.