We develop policies and procedures for data management in IoT environments and draft the contracts between the parties involved. This is made possible by an analysis of the ecosystem of connected devices and the related data flows. The policies and procedures establish a governance system for the collection of, access to, and sharing and retention of the data generated. We also prepare the contracts governing roles, responsibilities and rights between manufacturers, suppliers, users and recipients.