Map email classification, retention, model fallback and forwarding before assessing GDPR. A local model alone is not proof of compliance.