How are responsibilities defined in the data policy?