You are formulating a privacy policy and desire to include policy elements that will protect your company in the event of a regulatory audit. The primary information your company collects that would be considered sensitive is PII. Which of the following policy elements would you need to include in your policy to ensure that you are authorized to request this information from individuals per law or regulation?