The first steps in protecting the privacy of personal information is to identify
◦ what sensitive information is possessed by the organization.
◦ where sensitive information is stored.
◦ who has access to sensitive information.
◦ All of these are first steps in protecting privacy.