Architect for GDPR compliance

Redesign [Feature or System] to meet GDPR compliance requirements. Address the following obligations specifically: collecting only the personal data that is strictly necessary for the stated purpose, implementing the right to erasure so a user deletion request removes or anonymises all PII across all systems including logs and backups within the required timeframe, building a consent management layer that records consent with timestamp and version, enabling a data export that produces a machine-readable file of all data held about a user, handling cross-border data transfers with appropriate safeguards, and classifying and documenting all PII fields across services in a data inventory.