GDPR deletion lineage tracking

Under GDPR/CCPA, when a user requests deletion you must erase their personal data everywhere it propagated, but their PII has flowed from the source app DB through dozens of ETL jobs into warehouse tables, ML feature stores, derived aggregates, search indexes, caches, and analytics exports. Design a system that tracks where each user's PII lands and can fulfill a 'delete me' request completely and provably within the legal window, without breaking downstream tables that legitimately need aggregates. ~100M users, hundreds of datasets.