a policy which describes how a business handles data, for example in regards to processing, protection, quality and sharing
