A new privacy rule will take effect before deployment. What should the manager do first?

1. Assume the project is exempt because development started earlier
2. Wait for a regulator to reject the release
3. Copy another company's policy without assessing this project's obligations
4. Assess applicability and impact with qualified stakeholders, then update plans through governance