An undertaking has been signed by the Chartered Institute of Public Relations, following the loss of up to 30 membership forms on a train. The organisation didn't have a policy in place for handling personal data outside of the office at the time of the incident.