28 points to protect subject data