Data protection and handling policy