Adaptation to LGPD: Middleware Proposal for Implementing the Right to be Forgotten in Distributed Systems
software architecture; middleware; LGPD; privacy.
The inherent complexity of microservices architectures represents a significant obstacle to
the realization of the right to be forgotten, as required by the General Data Protection Law
(LGPD). The fragmentation of data across independently managed services, each with
its own business logic and data storage, makes consistent and reliable deletion a complex
challenge. This research addresses this problem by proposing an automated middleware
solution designed to orchestrate the deletion process across distributed microservices, using
the well-known two-phase commit (2PC) pattern to ensure data consistency, in addition to
offering a library to be imported into existing code and to facilitate adoption, requiring only
the implementation of the service’s own business rules. By evaluating its architecture and
performance in simulated environments, this study aims to demonstrate the effectiveness
and compliance of this automated approach to a problem currently fraught with manual
complexity and potential legal ramifications. Ultimately, this research strives to deliver
a robust and scalable solution that empowers organizations to effectively manage data
deletion in microservices environments, promoting greater trust and adherence to data
protection regulations.