presumably they are subject to audits. i work at a tech company that has to deal with data compliance and we take it incredibly seriously and have automated systems tracking, tagging, and deleting data everywhere.