GDPR erasure with lineage proof

Under GDPR right-to-erasure, when a user requests deletion you must remove their personal data everywhere it propagated within the legal deadline (e.g. 30 days), then PROVE it. A single user's data fans out from an OLTP source through CDC into a lakehouse, gets aggregated into derived tables, copied into a search index and a feature store, cached, and lands in append-only event logs and immutable backups. Design a system that finds every copy via lineage, deletes or anonymizes it, and produces an auditable certificate of erasure, without breaking aggregate analytics that don't actually need the identity.