You must have processes in place to assess the legal and regulatory implications of handling the data through its full lifecycle.