Based on government regulations, a Salesforce customer plans to implement the following in Salesforce for compliance:

Access to customer information based on record ownership

Ability for customers to request removal of their information from Salesforce

Prevent users from accessing Salesforce from outside company network (virtual private network, or VPN)

What should a data architect recommend to address these requirements?