Organisations are allergic to risk; bureaucracy is established to reduce it.  In the discussions of data, data protection are code words for higher organisational risk; not risk to beneficiaries or people.  The discussions tend to be focused on the legal and audit risk to the organisation.

If the discussions were truly about people, especially vulnerable people, then the legalise would disappear, being replaced by explanations in pictures, cartoons, videos, plain text.