Policy-processing of personal data