Data protection and cyber security: Foreign firms