Contracting for Cybersecurity and Data Privacy Protections