The policy applies to the government, its service providers, and private entities processing government data.