diff --git a/epdb/legacy_api.py b/epdb/legacy_api.py
index 431996ea..7ab9636b 100644
--- a/epdb/legacy_api.py
+++ b/epdb/legacy_api.py
@@ -881,12 +881,11 @@ def create_package_compound(
             if "secret" == classification.lower():
 
                 if p.classification_level != Package.Classification.SECRET:
-                    return 400, {"Cannot create PESs for non-secret packages."}
+                    return 400, {"message": "Cannot create secret PESs in non-secret packages."}
+
+                if not p.data_pool or not p.data_pool.secret:
+                    return 400, {"message": "Cannot create secret PESs in package without a secret data pool."}
 
-                data_pools = pes_data.get("dataPools")
-                if data_pools:
-                    if s.DATA_POOL_MAPPING[p.data_pool.name] not in data_pools:
-                        return 400, { "messsage": f"PES data pool {s.DATA_POOL_MAPPING[p.data_pool.name]} not found in PES data"}
 
             c = PESCompound.create(p, pes_data, c.compoundName, c.compoundDescription)
         else: