Within the framework of outsourcing, service providers receive and process large amounts of information from outsourcing customers. Depending on the protection needs of the information to be processed, insufficient rules may cause damage (e.g. if the related responsibilities are unclear). For example, the relevant rules and instructions might not be updated in the event of technical, organisational, or personnel changes, such as a change in contact person. The spectrum of inadequate rules ranges from unclear responsibilities and control functions to guidelines that are incomprehensible, incoherently formulated, or simply not in place.