digital data protection draft rules