Which of the Following Data Security Policies Is Most Likely

Which of the following data security policies is most likely to be the result of a data privacy law?

A) Access to personally identifiable information is limited to those who need it to perform their job.
B) Confidential data must be backed up and recoverable within a 24-hour period.
C) Updates to systems containing sensitive data must be approved before being moved to production.
D) A record of employees with access to insider information must be maintained, and those employees may not trade company stock during blackout periods.