Data protection obligations for processing personal data