You can always "redact" previous data. You can treat the sensible entries themselves as mutable, without it breaking the system design around immutable data.

I have also seen a scheme where you store the hash, and have a separate lookup table for sensible data, that you can redact more easily without messing with the log.