For example, if the retentions lead decides their team will use Dropbox, who ensures that it can be used in a GDPR compliant manner? Is it the same lead? What if they make a mistake?