Building a GDPR-compliant backend: an engineer's checklist

GDPR is usually treated as a legal checkbox bolted on at the end. The decisions that actually carry legal weight are architectural — and they are cheap early, expensive late.