Allocating enough resources and expertise to data protection and privacy issues is another concern in companies. Especially, SMEs may not have the knowledge, expertise or financial resources necessary to carry out data protection impact assessments, data breach notifications or data audits, in contrast to large companies.