We assisted an important public institution in drafting an internal regulation for the processing of personal data, identifying the different governance bodies responsible for processing. By determining the tasks of the different structures involved in the processing of data, the policy document helped the organization to streamline its processing operations and make its staff accountable, particularly with regard to processing activities that cut across several internal components.