OBLIGATIONS OF DATA CONTROLLERS AND PROCESSORS