Regulations like EU GDPR require such provenance - you can subcontract if you wish, but you're still liable if your subcontractor fails in some way.