Content required before publication
The approved policy must identify the organization responsible for personal information, the categories and purposes of collection, service providers, retention, safeguards, access choices, contact process, and effective date.