A data governance strategy has been defined by the IT strategy committee which includes privacy objectives related to access controls, authorized use. and data collection. Which of the following shoul

Mandating training is an implementation step that follows the creation of a policy, as training content would be based on the established policy.

Establishing a budget is a supporting activity for implementation, but the policy itself defines what needs to be budgeted for.

Performing a data privacy impact assessment (DPIA) is a process used for specific projects or systems to evaluate privacy risks, and it would be guided by an overarching data privacy policy.

A data privacy policy translates the high-level strategy and objectives into specific rules and guidelines for how the organization handles personal data, providing a framework for operationalizing privacy controls. This policy outlines responsibilities, procedures, and standards for access, use, and collection, ensuring consistent application across the enterprise.