The Step Most Businesses Skip (and Regret) When It Comes to Data Protection