When configuring information systems for the communication and transport of personal data, an organization should: