Security Lessons Learned and Good Practice in Data Protection