I think it just requires a different state of mind from people who develop software and services. At school, data protection was drummed into us from the beginn

I think it just requires a different state of mind from people who develop software and services. At school, data protection was drummed into us from the beginning and it stuck with me all those years later. It's just one of those issues you have to think about before building something - trying to avoid storing sensitive material wherever possible. This goes against modern trends where the retention of as much data as possible is favoured. I think the problem we see here, is a lot of start-ups and individuals are starting to think about it too far down the line. Whereas big, established companies have been dealing with this for decades, with departments dedicated to compliance - a bit like how everyone is building websites for accessibility to comply with disability laws.