I work in a highly regulated industry and I fail to see the benefits of self-hosting identity management in a context of mandatory compliance with GDPR and CCPA

I work in a highly regulated industry and I fail to see the benefits of self-hosting identity management in a context of mandatory compliance with GDPR and CCPA. 3rd party vendors relieve companies such as mine from a ton of responsibilities we'd otherwise have to handle and manage associated risks. Of course, we're the kind of company that think the less code and processes we have to be audited for, for, say, SOC2, the better. Which is pretty much every company, I assume. Please I'd very much appreciate diverse opinions on that topic.