Policies are used to describe and document your organization’s guidelines, regulations, standards or procedures to ensure data and data assets are properly managed and used. Some examples of policies are: Sensitive Data Handling and Data Sharing Agreement.

A policy is a natural-language description of a governance subject area. Policies describe how to control data. A policy consists of one or more rules. Each policy can:

• Contain multiple subpolicies.
• Reference a parent rule which needs to be sufficiently broad to encompass all of its subpolicies.
• Reference one or more Governance rules to describe the characteristics for making information resources compliant with corporate objectives.
• Reference one or more Data protection rules to create policies that specify types of data to restrict.
• Reference a related artifacts, such as business terms and classifications.

You can organize policies in a hierarchy based on their meaning and relationships to each other.

Policies have this scope:

• Data in relational data sets. Data assets with unstructured data and other types of assets are not protected by policies.
• All members of governed catalogs, regardless of their roles. The only user who is not subject to policies is the owner of the data asset. The owner of a data asset always sees the original values of that asset.

For example:

• A policy named "High Quality Data" states that data must meet a high quality standard.
• A subpolicy of "High Quality Data" called "High Quality Customer Data" states that customer data must meet a high quality standard.
• The "High Quality Customer Data" policy references a governance rule called "Postal Codes Verification".
• The "Postal Codes Verification" rule states that customer addresses must use valid postal codes, as provided by the post office.