There could be blanket clauses like reasonable efforts to secure private information, access controls, etc. They don't have to specify on the regulation what has to be done, just let prosecutors argue that it's not sufficient.