This required data protection act states and straightforward guide