Not that I am an auditor, but if the data ever hits your environment then you have a level of compliance to maintain.