GDPR and Keycloak: erasure, retention, and residency
Keycloak gives you a working mechanism for roughly half of what the GDPR asks of an identity provider, no mechanism at all for the other half, and — the part that costs people — one mechanism that looks like it worked and did not. It has no concept of a data subject request, no data export for one person, no retention default other than forever, and no setting anywhere called residency. What it does have is a complete admin API over every record it keeps, which is enough to build the rest if you know which four gaps to fill. This post maps each obligation to the mechanism that actually serves it, tested against Keycloak 26.8.2 on 2026-11-09, including the moment where a user erases their own account and Keycloak writes a fresh record of their username and IP address on the way out.