>Yes, you heard that correctly. We can secure ourselves like Fort Knox, but if your computer gets compromised and someone gets into your Mailchimp account, that's not good for either of us.
So mailchimp is SOC2, ISO, PCI, etc. and still gets worried about themselves if a user account is hacked.
Compliance with those standards doesn't mean they aren't potentially impacted by that sort of thing, and doing what they can to detect and mitigate unauthorized user account usages is part of at least a few of them.
"We retain a law firm in the UK to consult on EU privacy issues."
wouldn't it be better to retain a law firm that's actually in the EU? hiring a UK law firm for EU matters is no different that hiring a US law firm, or AUS, or whatever non-EU country
or, maybe i'm confusing them with ad agency types that i've worked with in the past and i'm just projecting one ego industry to another?