Identify data and information and legal, privacy and security measures

Identify the data and information the service will use or create. Put appropriate legal, privacy and security measures in place.