We, fortunately, already had the facilities in place to manage any personal information related to questions / answers and comments.
The content that you contribute (e.g. what you type in the box and submit) is given to us under the CC BY-SA 3.0 license perpetually and irrevocably. We require this because the presence of your contributions could prevent others from having contributed the same thing, meaning the removal of your contributions could leave 'holes' in the topics we cover and it's conceivable that all opportunities to acquire rare knowledge might have passed us by, because you already contributed it.
However, we reserve the right to permanently redact information that isn't critical to the viability of the contribution, and we very quickly comply with requests to remove inadvertent disclosures of proprietary or personal information (well, technically, we reserve the right to delete anything for any or no reason, but I digress).
We also comply with proper requests to remove copyrighted information that users didn't have the rights to contribute in the first place.
Now in the process of this, we also store some metadata about your post at the time it's created, because we need this information in order to be able to establish ownership in order to comply with the terms of our content license. Thus, along with a record of tags that were suggested, time / date, and other proprietary information, we also record your email address. We have a legitimate case to do this, because we must be able to verify any future requests from you to claim or disavow credit for the contribution.
GDPR gives you control over this, and we honor requests to scrub that information, similarly to how we'd scrub it if we determined that a user was not old enough to participate. We'd inform you that if you ever disavowed credit for contributing the knowledge we couldn't re-assign it to you (e.g. through deleting your account), but we'd honor it.
In our case, we were already structured so that we only stored what we had a very legitimate business case to store, and removal of random bits of personal information fortunately didn't result in any real disaster. That makes sense, if you think about it, because we only store enough information to connect you to a profile that displays nearly 100% of your activity to the public by default.
That's just an example, but it's one that shows that we don't like storing any more than we absolutely must, because weird things happen when people go away and you depend too much on what you knew about them.
Now, all products had unique challenges (Talent, Teams, etc), but the vast majority of our 'touches' are to the public Q&A platform. And even given that everything looked straight forward in theory, we had developers working nearly around the clock to make sure we were fully compliant.
The main lasting effect of this is a net good for anyone using the Internet - companies must carefully consider:
Do we have a legitimate business case for collecting this piece of information? Do we have a definite, prescribed use for it? How long do we need to retain it? Who will have access to it? How will it be shared?
... before they set any arbitrary cookie value. That's not just better information practice, that makes people consider better engineering in general, IMHO. That's one of the reasons why we so eagerly embraced it as the de-facto framework for handling information.