Writing Data Policies People Actually Follow

Opening Scene

A royal statute is written in such dense legal Latin that the village magistrates tasked with enforcing it can never actually explain it to the farmers it governs, so the farmers keep doing what they’ve always done, and the law exists everywhere except in practice — until a later ruler orders every new statute rewritten in the common tongue, with the specific behavior it requires spelled out in a single plain sentence.

In Plain English

A good data policy states, in language an ordinary employee can act on without a lawyer’s help, exactly what behavior is required or forbidden, who it applies to, and what happens if it’s violated. Enforceability and clarity matter more than legal completeness, because a policy nobody can actually follow provides no real protection despite how thorough it looks on paper.

The Old Way

Before clarity was treated as a design requirement:

Policies were drafted primarily to satisfy audit or legal review, with plain-language usability treated as a secondary concern at best.
Employees encountered policy documents only during onboarding, then never again until an incident forced someone to dig them up.
Violations went unaddressed because the policy never specified a concrete consequence or an owner responsible for enforcing it.

Writing for the person who has to follow the rule, not just the auditor who has to review it, is what makes a policy actually work.

What’s Changing (and Why AI Is the Reason)

Organizations increasingly test policies with the actual employees who’ll need to follow them before finalizing the wording, catching ambiguity early.
This connects to this content library’s dedicated AI governance and regulation series, since AI-specific policies in particular fail when they’re written in abstract, principle-level language instead of concrete, checkable requirements.
Shorter, clearer, more frequently updated policies are replacing dense annual documents, since fast-changing data and AI practices make a policy that’s only revisited once a year obsolete before most employees ever read it.

The Metaphor, Fully Extended

The Statute in Legal Latin	The Unusable Data Policy
Farmers who couldn’t understand the law kept the old ways	Employees who can’t parse the policy keep old habits
A magistrate unable to explain the statute plainly	A steward unable to enforce a policy consistently
The rewrite in the common tongue, specific and short	A policy written in plain, concrete, checkable language
Villagers finally able to recite the actual rule	Employees able to state the actual requirement in one sentence

For Beginners: What to Actually Do

Test any policy you write on a colleague outside the governance team and see if they can restate the actual requirement in their own words.
Avoid vague verbs like “ensure” or “appropriately manage” in favor of specific, checkable actions.
Read one existing policy at your organization and note anywhere you’d genuinely be unsure how to comply.

For Practitioners and Leaders: The Deeper Layer

Pilot new or revised policies with a small group of affected employees before rolling them out organization-wide.
Pair every policy with a named enforcement owner and a specific, proportionate consequence for violation.
Set a review cadence for policies shorter than the traditional annual cycle, especially for fast-moving areas like AI use.

Quick Recap

A policy only works if the people bound by it can actually understand and act on it.
Clarity and enforceability matter more than legal thoroughness on their own.
Policies need a named enforcement owner and a real consequence for violation.
Shorter, more frequently revisited policies are replacing dense annual documents.

Where This Fits in the Series

Article 6 introduced the council that produces and approves policy. Article 7 focused on what separates a policy that actually gets followed from one that just gets filed away. Article 8 turns to a related problem underneath policy: getting everyone to agree on what the words in those policies actually mean.