A behavioral event bus logs every signal emitted between engines. Those signals are personal data. This post examines the conflict between event logging for audit and GDPR data minimisation.
Key Analysis
Event bus logs contain personal data and are subject to GDPR data minimisation obligations. Retention policies for behavioral event logs must be defined before deployment, not after a breach. The distinction between audit logging (required) and surveillance (prohibited) is a policy decision, not a technical one.
Risk Signals
Event bus logs retained indefinitely without a defined retention policy. Event payloads containing personal data not listed in the DPIA.
Action Items
Define event bus log retention at design time — not after a regulator asks. Ensure event payloads are covered in your Data Protection Impact Assessment. Implement automated log purging aligned with retention policy.