Lawful basis, subject rights, consent, and where erasure collides with append-only design.
3 questions in Regulation & Compliance.
You delete from the operational store, propagate to every derived copy you can enumerate, and for the copies you cannot rewrite you rely on crypto-shredding, keyed compaction, snapshot expiry and exclusion at the next retrain.
A hand-maintained inventory is wrong the week after it is signed off, because new sinks, new fields inside existing payloads and human copies all arrive without a review. The map has to be derived from what the systems do, at field and purpose granularity.
Treat the two obligations as different purposes over different columns rather than a fight over one table. Keep the narrow set you are compelled to retain in a restricted, purpose-locked store the product cannot read, delete everything else on schedule, and make your compliance function name the retained fields.