Data security and privacy policies are ineffective and can even hinder business processes without a clear understanding of the data ― from what it is to where it exists. Data identity is the missing link that S&R leaders must define to create actionable policy. We designed this report to help S&R leaders develop effective security, privacy, and data handling policies using our Data Security And Control Framework as a guideline.