When the FTC investigates a company for a data spill, it’s usually because the organization made exaggerated security claims in its privacy policy—like falsely promising that customer data is stored only in encrypted form. When it comes to your published policies, make sure you walk the talk.