An organization plans to share customer data collected through an AI system with third-party vendors.

The strongest demonstration of compliance with privacy principles—especially those emphasized in AAIA, such as lawfulness, transparency, and consent —is obtaining expressed customer consent (B) before sharing data with third parties. Consent ensures that data processing aligns with legal and ethical requirements, reducing risks related to regulatory violations, unauthorized processing, and loss of customer trust.

Option A and C relate only to disclosure and transparency, which are necessary but insufficient. Option D concerns vendor security controls, which are important but do not address the legal basis for sharing data. Explicit, informed consent is the highest standard of compliance for third-party data sharing.