I certainly don't create a long living policy document for my own personal data though. There seems to be additional paper and process requirements above and beyond the technical aspects, at least according to the article.