Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing, Principles, Sensitive Data