There are general rules that cover data protection compliance. One is consent, where one should obtain consent before acquiring, holding, or using personal data wherever possible. It is also necessary to be careful with sensitive personal data, such as those pertaining to race, political opinion, health status, religious belief, sexuality, and criminal offense. https://securechannelsinc.blogspot.com/2017/09/basic-rules-for-data-protection.html