How To Apply For Compliance Library Effectively

Published

how to apply for compliance library
Table of Contents

Navigating regulatory demands in industries like finance healthcare and manufacturing requires a robust compliance library to mitigate risks and ensure operational integrity. Without structured documentation frameworks organizations face heightened exposure to audits fines and reputational damage often stemming from gaps in policy adherence or outdated records. This guide provides a systematic approach to establishing maintaining and securing a compliance library aligned with global standards such as GDPR SOX and ISO 27001 ensuring resilience against evolving threats.

The process begins with a clear understanding of regulatory scope followed by meticulous workflow design stakeholder coordination and integration of specialized tools. Each step is underpinned by version-controlled templates access controls and real-time updates to sustain compliance in dynamic environments. By implementing these strategies organizations not only fulfill legal obligations but also foster a culture of accountability and continuous improvement.

how to apply for compliance library

Understanding the Purpose and Scope of a Compliance Library

A compliance library serves as the centralized repository for all regulatory documentation, policies, procedures, and evidence required to demonstrate adherence to legal and industry-specific standards. In highly regulated sectors such as finance, healthcare, manufacturing, and energy, these libraries are critical for mitigating risks, ensuring operational integrity, and avoiding severe financial or reputational consequences. Their scope extends beyond mere documentation storage to include version control, accessibility, audit trails, and integration with compliance management systems.

The primary objectives of a compliance library include:

  • Regulatory Alignment: Ensuring all organizational activities conform to applicable laws and standards.
  • Risk Mitigation: Reducing exposure to legal, financial, and operational risks through structured compliance evidence.
  • Audit Readiness: Facilitating seamless internal and external audits by providing organized, traceable documentation.
  • Stakeholder Transparency: Demonstrating compliance to regulators, customers, investors, and partners through clear, accessible records.

    • Core Objectives of a Compliance Library in Regulated Industries

    Regulated industries rely on compliance libraries to systematically address the complexities of overlapping and evolving regulatory requirements. These objectives are particularly critical in sectors where non-compliance can lead to systemic failures, such as financial market collapses, patient safety breaches, or environmental disasters.

    Key functions of a compliance library include:

  • Policy and Procedure Standardization: Maintaining up-to-date, version-controlled policies aligned with regulatory expectations.
  • Documentation Traceability: Tracking changes, approvals, and revisions to ensure accountability and transparency.
  • Automated Compliance Monitoring: Integrating with tools to flag gaps, expirations, or inconsistencies in compliance documentation.
  • Training and Awareness Support: Providing accessible resources for employees to understand their compliance obligations.
  • Incident Response Readiness: Storing evidence and protocols for investigations, disputes, or enforcement actions.

    • Key Regulatory Frameworks and Their Compliance Requirements

    Regulatory frameworks vary by industry but often share overlapping requirements, particularly in data protection, financial reporting, and operational security. Below is a structured comparison of major regulations, their primary industries, and the documentation essential for compliance.
    Regulation Name Primary Industry Key Compliance Documents Needed Common Penalties for Non-Compliance
    General Data Protection Regulation (GDPR) All industries handling EU citizen data
    • Data Processing Agreements (DPAs)
    • Records of Processing Activities (ROPA)
    • Data Protection Impact Assessments (DPIAs)
    • Privacy Notices and Consent Forms
    • Incident Reporting Logs (within 72 hours)
    • Fines up to 4% of global annual revenue or €20 million (whichever is higher)
    • Reputational damage and loss of customer trust
    • Legal actions for data breaches
    Sarbanes-Oxley Act (SOX) Publicly traded companies (U.S.)
    • Internal Controls Documentation (e.g., COSO Framework)
    • Financial Statement Audits and Management Assertions
    • Whistleblower Protection Policies
    • Code of Ethics for Senior Executives
    • IT General Controls (ITGC) Evidence
    • Criminal penalties for executives (up to 20 years imprisonment)
    • Fines up to $5 million for corporations
    • Stock exchange delisting
    Health Insurance Portability and Accountability Act (HIPAA) Healthcare providers, insurers, and business associates (U.S.)
    • Privacy and Security Rule Policies
    • Business Associate Agreements (BAAs)
    • Breach Notification Reports
    • Workforce Training Records
    • Risk Analysis and Management Plans
    • Fines up to $1.5 million per violation (capped at $1.5 million annually per violation type)
    • Criminal charges for willful neglect (up to 10 years imprisonment)
    • Loss of Medicare/Medicaid funding
    ISO 27001 (Information Security Management System) Global (all industries)
    • Statement of Applicability (SoA)
    • Risk Treatment Plans
    • Incident Response Procedures
    • Access Control Policies
    • Third-Party Security Assessments
    • Loss of certification and market trust
    • Contractual penalties for non-compliant vendors
    • Increased cyber insurance premiums
    Note: Overlapping requirements are common, particularly in data security (e.g., GDPR and ISO 27001) or financial integrity (e.g., SOX and Basel III). Organizations must map these frameworks to avoid redundancy while ensuring full coverage.

    Real-World Compliance Failures Due to Inadequate Documentation

    Insufficient or disorganized compliance documentation has led to high-profile failures, often resulting in regulatory sanctions, financial losses, and operational disruptions. Below are examples with key lessons learned:
    Example 1: Equifax Data Breach (2017) – GDPR/HIPAA Non-Compliance The breach exposed 147 million records due to unpatched software and poor access controls. Investigations revealed:
  • Lack of documented risk assessments for critical systems.
  • Inadequate logging and monitoring of security events.
  • Failure to implement least-privilege access policies.
    • Lesson Learned: Compliance libraries must include real-time monitoring evidence and automated audit trails to detect anomalies promptly. Documentation gaps in risk management directly correlate with exploitability.
    Example 2: Wells Fargo Fake Accounts Scandal (2016) – SOX Non-Compliance The bank’s aggressive sales practices led to 2 million unauthorized accounts, violating SOX’s internal controls requirements. Findings included:
  • Missing documentation of employee training on ethical sales practices.
  • Weak oversight of cross-departmental compliance (e.g., retail banking vs. risk management).
  • Incomplete audit trails for account-opening processes.
    • Lesson Learned: Compliance libraries must integrate with operational workflows to ensure policies are enforced at every touchpoint. SOX requires not just documentation but proof of execution.
    Example 3: Anthem Data Breach (2015) – HIPAA Non-Compliance Hackers exploited unpatched vulnerabilities, accessing 78 million patient records. Key failures:
  • Outdated access logs and insufficient multi-factor authentication (MFA) documentation.
  • No evidence of regular security awareness training for employees.
    • Lesson Learned: HIPAA’s Security Rule mandates documentation of all safeguards. A compliance library must serve as a single source of truth for both technical and administrative controls.
    Example 4: Volkswagen Emissions Scandal (2015) – ISO 14001/Industry Regulations The "Dieselgate" scandal involved undocumented software modifications to evade emissions tests. Critical oversights:
  • Lack of version-controlled records for software updates in compliance libraries.
  • Inadequate third-party vendor oversight documentation.
    • Lesson Learned: Compliance libraries must enforce strict change management protocols, including approval chains and impact assessments for all modifications.
    Common Thread: In each case, the root cause was not the absence of policies but the failure to document their implementation, monitoring, and exceptions. A robust compliance library acts as both a

    Step-by-Step Process to Establish a Compliance Library

    The establishment of a compliance library requires a structured approach to ensure all regulatory requirements are systematically captured, organized, and maintained. This process involves collaboration across key business functions, the selection of appropriate tools, and the implementation of a scalable framework for document management. Below is a sequential workflow diagram, described in plaintext for conversion into a visual or interactive format, along with detailed steps for execution.

    Sequential Workflow Diagram for Compliance Library Setup

    The workflow consists of six core phases, each dependent on the completion of prior steps. The diagram can be visualized as a linear progression with feedback loops for iterative refinement:

    1. Stakeholder Identification and Alignment

  • Define roles (legal, IT, operations, risk management) and responsibilities.
  • Conduct a kickoff meeting to align on compliance objectives and governance structure.

    • 2. Policy Inventory and Gap Analysis

  • Catalog existing policies, procedures, and regulatory obligations.
  • Identify gaps between current controls and required compliance frameworks (e.g., GDPR, SOX, HIPAA).

    • 3. Tool and Technology Selection

  • Evaluate document management systems (DMS), e-signature platforms, and compliance automation tools.
  • Assess integration capabilities with existing enterprise systems (e.g., ERP, HRIS).

    • 4. Document Classification and Organization

  • Structure compliance artifacts into hierarchical categories (e.g., policies → procedures → training records).
  • Implement metadata tagging for searchability and version control.

    • 5. Integration of Third-Party Tools and APIs

  • Map data fields between internal systems and third-party compliance platforms (e.g., Vanta, Drata).
  • Configure automated workflows for real-time compliance monitoring.

    • 6. Validation and Continuous Improvement

  • Conduct a compliance audit to verify artifact completeness and accuracy.
  • Establish a review cycle for updates to regulations or internal policies.

    • Stakeholder Identification and Alignment

    Collaboration between legal, IT, and operations teams is critical to ensure the compliance library meets both regulatory and operational needs. The following roles should be defined with clear ownership:

    - Legal/Compliance Team: Owns policy interpretation, regulatory mapping, and audit readiness.

  • IT/Information Security: Manages access controls, document encryption, and system integrations.
  • Operations/Risk Management: Ensures procedural alignment with business processes and risk assessments.
  • HR/Training: Coordinates compliance training records and employee acknowledgments.
    • Key Principle: Stakeholder alignment reduces silos and ensures the library addresses cross-functional requirements.
    A sample stakeholder alignment matrix (for table conversion) includes:
    StakeholderResponsibilityDeliverable
    Legal TeamRegulatory mappingApproved policy framework
    IT SecurityAccess controls, encryptionSecure document repository setup
    OperationsProcess integrationUpdated SOPs with compliance references
    HR/TrainingEmployee training recordsAcknowledgment logs for policies

    Policy Inventory and Gap Analysis

    A comprehensive inventory of existing policies and procedures forms the foundation of the compliance library. This step involves:

    1. Document Collection

  • Gather policies from legal, HR, IT, and operations departments.
  • Include third-party agreements (e.g., vendor contracts, SLAs) if relevant.

    • 2. Regulatory Mapping

  • Align policies against applicable frameworks (e.g., GDPR Article 5 for data processing).
  • Use a compliance matrix to track coverage (e.g., "Does the Data Retention Policy comply with GDPR’s 5-year requirement?").

    • 3. Gap Identification

  • Flag missing policies (e.g., "No written incident response plan for SOX").
  • Prioritize gaps based on risk exposure (e.g., high-risk areas like data privacy).
    • Example Gap Analysis Template:
  • Regulation: GDPR Article 30 (Records of Processing Activities)
  • Current State: No centralized log of data flows.
  • Gap: Non-compliance with Article 30 requirements.
  • Action: Implement a data mapping tool (e.g., OneTrust) to track processing activities.

    • Tool Selection for Compliance Library Management

    The choice of tools depends on the organization’s size, regulatory scope, and technical infrastructure. Key categories include:

    - Document Management Systems (DMS)

  • Features: Version control, access permissions, audit trails.
  • Examples: SharePoint, Google Workspace, Alfresco.
  • Consideration: Ensure compliance with records retention laws (e.g., eDiscovery readiness).

    • - E-Signature Platforms

  • Features: Legally binding signatures, timestamping, compliance with UETA/ESIGN.
  • Examples: DocuSign, Adobe Sign, PandaDoc.
  • Use Case: Policy acknowledgments by employees or vendors.

    • - Compliance Automation Tools

  • Features: Automated policy updates, regulatory change alerts, evidence collection.
  • Examples: Vanta (SOC 2), Drata (ISO 27001), OneTrust (GDPR).
  • API Requirements: RESTful APIs for data synchronization (e.g., pulling audit logs from SIEM tools).
    • Tool Selection Checklist:
  • Does the tool support role-based access control (RBAC) for sensitive documents?
  • Can it integrate with existing identity providers (IdP) like Okta or Azure AD?
  • Does it offer automated reminders for policy reviews (e.g., annual SOX assessments)?

    • Organizing Compliance Documents by Category

    A nested bullet-point structure ensures documents are logically grouped and easily retrievable. Below is an example hierarchy for a GDPR-focused compliance library:

    1. Policies

  • Data Protection
  • [Company Name] Data Processing Agreement Template
  • Data Retention and Deletion Policy
  • Governance
  • GDPR Compliance Framework Policy
  • Third-Party Vendor Risk Policy

    • 2. Procedures

  • Data Subject Rights
  • Procedure for Handling DSARs (Data Subject Access Requests)
  • Incident Response
  • GDPR Breach Notification Procedure

    • 3. Training Records

  • Employee Training
  • GDPR Awareness Module Completion Logs (2023)
  • Vendor Training
  • Vendor GDPR Compliance Certification Records

    • 4. Audit and Evidence

  • Audit Logs
  • System Access Logs (SIEM Export for GDPR Article 30)
  • Certifications
  • ISO 27001 Audit Report (2024)
    • Best Practice: Use metadata fields (e.g., "Regulation," "Effective Date," "Owner") to enable advanced filtering in the DMS.

    Checklist for Validating Mandatory Compliance Artifacts

    The following checklist ensures all required artifacts are included in the library. Placeholders (e.g., "[Company Name]") should be customized based on the organization’s context.
    • Regulatory Policies
      • [Company Name] Privacy Policy (aligned with GDPR/CCPA)
      • [Company Name] Data Breach Response Plan (SOX/GDPR)
      • [Company Name] Vendor Management Policy (ISO 27001)
    • Procedures and Workflows
      • Step-by-step guide for processing DSARs (GDPR)
      • Incident response checklist for PCI DSS compliance
      • Procedure for annual SOX 404 controls testing
    • Training and Acknowledgment Records
      • Employee compliance training certificates (e.g., HIPAA for healthcare staff)
      • Vendor compliance acknowledgment forms (e.g., SOC 2 Type II)
    • Audit and Evidence Documentation
      • Quarterly access reviews (NIST SP 800-53)
      • Retention logs for financial records (SOX Section 302)
      • Third-party audit reports (e.g., ISO 27001, SOC 2)
    • Technical Controls and Configurations
      • Network segmentation diagrams (NIST CSF)
      • Encryption key management records (GDPR Article 32)
      • SIEM alert logs for suspicious activity (PCI DSS)
    • Third-Party Integrations

      how to apply for compliance library - Ilustrasi 2

      Documentation Standards and Templates for Compliance

      Compliance documentation serves as the foundation for regulatory adherence, risk mitigation, and operational consistency. Structured templates and standardized formats ensure policies are clear, enforceable, and aligned with evolving regulatory requirements. This section outlines a compliance policy template, version-control methodologies, and tools for maintaining up-to-date documentation.

      Compliance Policy Document Template

      A well-structured compliance policy document balances regulatory precision with operational clarity. Below is a standardized template organized into four columns: Section Header, Regulatory Reference, Required Content, and Example Language. This format ensures traceability, audit readiness, and ease of updates.
      Section Header Regulatory Reference Required Content Example Language
      Purpose and Scope ISO/IEC 27001:2022, Clause 5.2
      • Objective of the policy (e.g., "Ensure data protection in accordance with GDPR").
      • Applicable departments/roles.
      • Exclusions (e.g., third-party vendors not under direct control).

      "This policy establishes the framework for protecting personally identifiable information (PII) as required by Article 5 GDPR. It applies to all employees, contractors, and third-party vendors processing PII on behalf of [Organization Name]. Exceptions include data handled by [Specify Excluded Entity] under separate agreements."
      Access Controls NIST SP 800-53 Rev. 5, Control AC-3
      • Role-based access control (RBAC) matrix.
      • Approval workflow for access requests.
      • Periodic access reviews (frequency: quarterly).

      "Access to sensitive systems is granted only to authorized personnel based on the least-privilege principle. Requests must include justification, supervisor approval, and a review every 90 days. Example roles: Admin, Audit, Data Entry."
      Data Retention and Disposal EU GDPR, Article 5(1)(e)
      • Retention periods for each data category (e.g., "Customer records: 7 years").
      • Secure disposal methods (e.g., encryption, shredding).
      • Audit logs for disposal activities.

      "Customer transaction records shall be retained for 7 years from the date of last activity, after which they shall be permanently deleted via NIST SP 800-88 Rev. 1-compliant media sanitization. Exceptions require Data Protection Officer (DPO) approval."
      Incident Response Plan ISO/IEC 27035:2021, Clause 6.2
      • Classification tiers (e.g., "Tier 1: Minor breach, Tier 3: Critical").
      • Reporting timelines (e.g., "Tier 3 incidents reported within 1 hour").
      • Stakeholder notification matrix.

      "A Tier 3 incident (e.g., unauthorized access to PII affecting >10,000 records) triggers immediate notification to the DPO, Legal, and Regulatory Authority within 1 hour. Escalation paths are documented in Appendix B."
      Key Considerations for Template Adoption:
    • Regulatory Mapping: Cross-reference sections with frameworks like GDPR, HIPAA, or SOC 2 to ensure comprehensive coverage.
    • Customization: Tailor example language to industry-specific risks (e.g., healthcare vs. fintech).
    • Legal Review: Engage compliance officers or external counsel to validate language for enforceability.

      • Version Control for Compliance Documents

      Semantic versioning (e.g., v1.2.3) provides a structured approach to tracking changes in compliance documents, where:
    • Major (1): Breaking changes (e.g., policy overhaul due to new legislation).
    • Minor (2): Additive updates (e.g., new control added).
    • Patch (3): Corrective edits (e.g., typo fixes or minor clarifications).

      • Implementation Steps:
      1. Metadata Embedding:

    • Store version history in document properties (e.g., Microsoft Word’s "Document Information Panel" or PDF metadata).
    • Example metadata fields:

      • Title: Data Protection Policy
      Version: v2.1.0
      Last Updated: 2024-05-15
      Approved By: [Name], Compliance Officer
      Change Log: [Link to version history document]

      - Use XML-based formats (e.g., DITA) for complex libraries to automate metadata extraction.

      2. Versioning Workflow:

    • Draft Phase: `vX.Y.Z-draft` (e.g., `v2.1.0-draft`).
    • Approval Phase: `vX.Y.Z-pending` (awaiting stakeholder sign-off).
    • Published Phase: `vX.Y.Z` (finalized and distributed).

      • 3. Tools for Version Control:

    • Git (for code-like documents): Ideal for collaborative editing with commit logs.
    • Confluence/SharePoint: Centralized repositories with built-in versioning.
    • Legal Tech Platforms (e.g., Logikcull): Automate version tracking for regulatory changes.

      • Example Version History Table:

      Version Change Type Date Description Approver
      v1.0.0 Initial Release 2023-11-10 Baseline GDPR compliance policy. Jane Doe, DPO
      v1.2.1 Patch 2024-02-20 Clarified scope for third-party vendors. John Smith, Legal
      v2.0.0 Major 2024-05-15 Added NIS2 Directive requirements. Regulatory Affairs Team

      Manual vs. Automated Document Generation Tools

      The choice between manual and automated tools depends on scalability, accuracy, and resource constraints. Below is a comparative analysis:

      Manual Tools (e.g., Microsoft Word Macros, Excel Templates):

      • Pros:
        • Full customization for niche regulatory needs.
        • Lower upfront cost; no dependency on third-party vendors.
        • Familiarity for teams already using Microsoft Office.
      • Cons:
          <

          Access Control and Security Measures for the Compliance Library

          A robust compliance library requires stringent access controls and security measures to safeguard sensitive regulatory documents, internal policies, and audit trails from unauthorized access or breaches. Role-based access control (RBAC) ensures that users interact with the library only within the scope of their responsibilities, while encryption, audit trails, and penetration testing mitigate risks associated with data exposure or manipulation. This section outlines a structured RBAC framework, encryption protocols, storage compliance requirements, and proactive security testing methodologies to align with industry standards such as GDPR, HIPAA, and SOC 2.

          Role-Based Access Control (RBAC) Matrix for Compliance Library

          An RBAC matrix defines granular permissions based on job functions, ensuring least-privilege access while maintaining operational efficiency. The following table categorizes roles, permissions, audit requirements, and authentication levels to enforce security without disrupting workflows.
          Role Permissions Audit Trail Requirements Multi-Factor Authentication (MFA) Level
          Compliance Officer
          • Full read/write access to policies, procedures, and audit reports.
          • Approval rights for document revisions.
          • Access to third-party compliance tools (e.g., OneTrust, MetricStream).
          • Log all document modifications with timestamps and user IDs.
          • Track policy approval/rejection workflows.
          • Generate monthly access reviews for privileged roles.
          		 Hardware token (YubiKey) + SMS/email OTP.
          Legal Counsel
          • Read-only access to legal contracts and GDPR/HIPAA-specific documents.
          • Write access limited to draft legal templates.
          • No access to financial or HR compliance records.
          • Audit document downloads for litigation holds.
          • Alert on unauthorized edits to legal templates.
          		 SMS/email OTP + biometric verification (fingerprint/face ID).
          IT Security Administrator
          • System-level access to configure RBAC and encryption.
          • Read-only access to audit logs.
          • Ability to revoke access for terminated employees.
          • Log all permission changes with justification.
          • Alert on failed MFA attempts (3+ within 5 minutes).
          		 Hardware token + certificate-based authentication.
          Department Heads (Finance/HR)
          • Read access to department-specific compliance documents (e.g., SOX controls for Finance).
          • Write access to local policies (e.g., HR harassment training records).
          • No access to cross-departmental audit trails.
          • Track document access during regulatory inspections.
          • Alert on bulk downloads of sensitive data.
          		 SMS/email OTP + push notification approval.
          External Auditors
          • Read-only access to pre-approved audit packages.
          • No ability to modify or export documents.
          • Session timeouts after 4 hours.
          • Log all queries and document views for forensic review.
          • Require manual approval for additional access requests.
          		 Temporary hardware token + video verification.
          Key Considerations for RBAC Implementation:
        • Just-in-Time (JIT) Access: Grant temporary elevated permissions (e.g., for audits) with automatic revocation post-task completion.
        • Privileged Access Management (PAM): Use tools like CyberArk or BeyondTrust to monitor and record sessions for roles with system-level permissions.
        • Role Rotation: Enforce periodic reviews (quarterly) to ensure roles align with current job functions and regulatory changes.

          • Encryption and Storage Compliance for Sensitive Documents

          Sensitive compliance documents—such as GDPR data subject requests, HIPAA patient records, or SOC 2 control narratives—require encryption both in transit and at rest. The choice of encryption algorithm and storage medium must align with regulatory mandates and organizational risk tolerance.

          Encryption Standards for Compliance Documents:

        • AES-256: The gold standard for symmetric encryption, compliant with GDPR (Article 32), HIPAA (164.312(a)(2)(iv)), and FIPS 140-2/3.
          • AES-256 encrypts data using a 256-bit key, with a theoretical key space of 2256 possibilities, making brute-force attacks computationally infeasible.
    • RSA-2048/4096: Asymmetric encryption for secure key exchange or digital signatures, required for compliance with PCI DSS (v4.0) for cryptographic controls.
    • Hashing (SHA-3): Used for integrity checks (e.g., verifying audit logs) but not for confidentiality.

      • Storage Requirements by Compliance Framework:

      Compliance Standard Encryption Requirement Storage Medium Additional Controls
      GDPR AES-256 for personal data; key management via HSM or KMS.
      • On-premise (e.g., Dell EMC PowerScale with self-encrypting drives).
      • Cloud (AWS KMS or Azure Key Vault with customer-managed keys).
      • Right to erasure (Article 17) requires automated data deletion workflows.
      • Data residency clauses may restrict cloud storage to EU-based providers.
      HIPAA AES-256 for ePHI; FIPS 140-2 validated modules for hardware security.
      • On-premise (e.g., IBM Storwize with FIPS 140-2 drives).
      • Cloud (HIPAA-eligible providers like Google Cloud with DICOM/PACS integration).
      • Business Associate Agreements (BAAs) for third-party cloud vendors.
      • Access controls for "minimum necessary" principle (45 CFR §164.502(b)).
      SOC 2 AES-256 or equivalent; key rotation every 90 days.
      • On-premise (e.g., NetApp ONTAP with volume encryption).
      • Cloud (SOC 2 Type II certified providers like AWS or Salesforce).
      • Logical access controls (e.g., role-based segmentation).
      • Disaster recovery testing (RTO < 4 hours for critical data).
      PCI DSSA well-constructed compliance library serves as the backbone of regulatory adherence transforming potential vulnerabilities into strategic advantages. Through structured documentation versioning and automated workflows organizations can proactively address changes in legislation while maintaining audit readiness. The integration of role-based access controls encryption and continuous monitoring further fortifies the library against internal and external threats ensuring data integrity and operational continuity. Ultimately this framework empowers teams to navigate compliance complexities with confidence precision and long-term sustainability.

      Leave a Comment

      Comments are moderated before appearing. The data you submit is processed according to the Privacy Policy of ir.msu.ac.zw.