data protection framework