Principles of Data Security – what you should have in place