The key legal obligations a business should consider when dealing with personal data about customers