It defines the key personal data protection principles, the roles and related macro-responsibilities and information flows to/from the Board of Directors, senior management, the units involved in the creation of the data protection framework and those involved in the processing of personal data, as well as the data subjects.