1.2.3.1 Establish requirements and procedures to ensure privacy and security of the data