Scope of personal data protection policy