Those in this category, such as insurance companies, banks and recruiting firms, are required to take specific steps to protect personal information in their possession, including creating an express policy to be distributed to those whose personal information they receive.