How to establish defensible data processing documentation