In a Multi-Function Peripheral (MFP), identification information readable from an IC card is accepted, an administrator ID and an administrator password are used to access a policy server, a policy is registered in the policy server based on the accepted identification information, and storage of an encrypted file including image data obtained by a scan is controlled. A security setting in accordance with the policy based on the identification information is associated with the encrypted file, and a restriction of at least a part of an operation on the file is enabled in accordance with the security setting in accordance with the policy.