I have been reading alot about user consent management according to the GDPR and one problem I can't see solved anywhere is managing withdrawn consent.
The user gives his consent to use his data and save personal information like his E-Mail address, IP address, ...
If the user withdraws his consent I would have to somehow store this decission in my database to make sure I always have proof of a prior consent and at which date the user has withdrawn his consent. But how do I keep track of a withdrawn consent if I can't save any personal information to identify this person anymore. Isn't this a contradiction? Always having the ability to prove everything but being forced to delete all saved data records?
Is there any part of the GDPR I am missing, that solves this specific problem?