Data protection is a journey, not a destination