data privacy enforcement