data protection investigation