Legal requirements for data-driven businesses