Security and data privacy due diligence