The primary focus of these is on a data privacy management system and a compliance structure in the company that takes account in particular of the core processes for lawfulness of processing, protection of the rights of individuals, and handling of data privacy incidents.