How privacy-aware is your organisation?