As a general rule, data operator on its own determines the measures necessary and sufficient to ensure the fulfillment of its obligations to ensure data protection. Such measures might include, for example, issuance of internal codes of practice on personal data processing or implementation of internal control and (or) audit of compliance of personal data processing with the applicable legislation. Given the absence of contractual safeguards between businesses (e.g., model contracts) or binding corporate level instruments, private sector safeguards are below  the best practice benchmark.