Which of the following should FIRST be established before a privacy office starts to develop a data protection and privacy awareness campaign?