Within the course framework used for this question, the correct response is the U.S. Patriot Act . The curriculum's discussion of customer-information security emphasizes that organizations collecting, processing, storing, or transmitting sensitive customer information must recognize both their legal obligations and their broader ethical responsibility to safeguard that information.
The source material contrasts several jurisdiction-specific privacy or information-security frameworks and identifies the U.S. Patriot Act in connection with U.S. requirements. The Data Protection Act is associated with the United Kingdom in that course treatment, while the remaining alternatives are not the U.S. statute identified by the material. The corresponding test bank explicitly marks option D as the answer.
Operationally, information governance should extend beyond regulatory compliance. Firms should implement documented privacy policies, appropriate access controls, security monitoring, controlled data retention, employee awareness, and procedures governing customer preferences and information disclosure. These controls are particularly important where CRM and digital supply-chain systems consolidate substantial amounts of identifiable customer information.
Therefore, using the terminology and legal classification required by this ACSCP question, the correct answer is D .
Reference Topic: Risk Management, Compliance and Resilience — Customer Information Security, Privacy, and Regulatory Compliance.
===============
