Risk appetite

There is a clear statement from the Board that sets out expectations of the organisation on data protection and privacy including clear decisions that must be made by the Board