A privacy request requires removal of eligible personal records, but some records are subject to a lawful retention requirement. Which approach best fits?

1. Establish data ownership and catalog governance metadata.
2. Apply a reviewed retention and deletion policy that accounts for legal obligations.
3. Maintain and inspect data lineage.
4. Grant separate least-privilege data and pipeline administration roles.