Obligations of controllers and processors