Which of the following would be MOST important to include in a data security policy to adequately manage the privacy of customer information?