Data Protection: What you can and can’t do