Data policy, knowing what and how data is stored, would be good enough