[merijnv]

> If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source.

So...basically the GDPR? Well, not quite, since the GDPR doesn't require consent attestation, "merely" a legal basis. Of which consent is just one (the most useless one to use as a company).