Cybersecurity and data privacy due diligence