A security engineer is configuring Microsoft Purview to track the consent and purpose limitation for personal data used in AI model training. The GDPR requires that data is only used for purposes consented to by data subjects. Which Microsoft Purview feature helps manage and demonstrate consent-based data processing compliance?

Compliance Manager provides control-mapping templates for regulations, and GDPR is one of them. Building an assessment from the GDPR template lists the controls that apply, including those covering lawful basis, consent, and purpose limitation, and pairs them with improvement actions the organization implements, tests, and documents with evidence. That gives the security engineer a structured way to manage consent-related obligations and demonstrate progress to auditors or a data protection officer. The Data Map option is wrong because custom attributes on data assets only describe metadata; they provide no control framework or compliance evidence for consent. The Privacy Risk Management with subject rights request option is wrong because those are Microsoft Priva capabilities rather than Purview ones, and they focus on privacy risk policies and fulfilling individual rights requests, not on tracking consent controls against GDPR. The Data Lifecycle Management option is wrong because retention labels govern how long content is kept or deleted, and they do not show that processing matches the purposes data subjects agreed to. For the exam, remember that Compliance Manager measures and documents compliance posture rather than capturing individual consent records. A practical check is to open the GDPR assessment and confirm the consent-related improvement actions have owners, status, and evidence attached.