Legal requirements for data protection