Not right; you can't just review the specs of each system. It's very easy to accidentally combine compliant systems in a way that isn't compliant. Just to pick

Not right; you can't just review the specs of each system. It's very easy to accidentally combine compliant systems in a way that isn't compliant. Just to pick one example I've seen in practice, system A might have an integration bug causing system B to periodically emit error logs, containing data which system A knows is personal but system B does not.