Clear data security expectations must be set across the organization.