Mapping Out a Data Protection Plan