2.4.2 Assess data ownership rules