We define necessary data, authorised access and source-system boundaries before implementation. Your organisation approves privacy and retention requirements.