Regulatory Requirements for Protecting User Data