Applying SABSA to GDPR data protection obligations — sovereignty, privacy by design, and regulated enterprise governance.