Draft data privacy policy for regulatory compliance