Data privacy compliance policy development