Yep.

The core data should sit behind some kind of service that enforces legal, compliance, and security policies.

Then tools that access the data in a compliant way should be given a lot of flexibility for what tech stacks they use to process the data.