Data privacy compliance framework design