Entity has a documented Data Protection policy which includes staff members’ responsibilities with handling personal data as per the company’s regulatory requirements