We're small enough not to have a legal team yet. But if we did, this is not something I'd be overruled on easily. The technical issues seem pretty clear cut, an

We're small enough not to have a legal team yet. But if we did, this is not something I'd be overruled on easily. The technical issues seem pretty clear cut, and if you have a written policy in place (and it was there before anything bad happened) I can't see how it's a genuine risk. It was also no problem for our ISO27001.