Declaring that staff may not use company equipment for personal purposes does not mean that the institution may have limitless access to any data on the equipment. The institution still should prepare its personal data collection statement, indicating the scope and purposes of data access on its equipment. If the institution makes no statement to the staff in advance, it will risk breaching the law, or even committing crime or administrative offence.