Which of the following should an IS auditor review FIRST when planning a customer data privacy audit?