controllers and processors of personal data must follow necessary processes, such as, notification of objectives on collecting, processing or disclosing the personal data, requesting of consents, protection