What are considerations in data protection planning?