Which of the following is a requirement of the 'Privacy' Trust Services Criterion?

Data is encrypted at rest.

Personal information is collected, used, retained, disclosed, and disposed of in conformity with the entity's privacy notice.

System processing is valid and accurate.

The system is protected against unauthorized access.