Best Practice for Data Protection Requirements