data privacy regulations for IT companies