The “Information security and data protection” group guideline, which is binding for all associates, defines duties, processes, and responsibilities, and sets out specific rules on how to handle information.