You're right, that's why I added GDPR/Data control might be an issue.

If you read it again, you can see I'm talking about management of security, not the legal issues of it.