The correct, robust data protection and privacy policies will ensure the culture set by the directors is reflected in the data's ethical use