In the picture: A data protection code of practice