Development of a data protection policy