This is exactly right. It doesn't stop espionage or a rogue employee - it is not supposed to; but it does stop inadvertent duplication all over the place in ways the company could be liable for due to inaction or insufficient policy around PII, etc.