Rationalizing requirements is part of the "Assess" phase of the IAPP Privacy Operational Life Cycle. This phase involves identifying, analyzing, and harmonizing various legal and regulatory obligations to create a unified and efficient compliance strategy. The activities include harmonizing shared obligations (A), choosing a strategic approach like applying the strictest standard (C), and planning for unique requirements or outliers (D).

Implementing a solution (B), however, falls under the subsequent "Protect" phase of the life cycle. The "Protect" phase is where the policies, controls, and processes derived from the "Assess" phase's rationalization efforts are put into practice. Therefore, implementation is the result of rationalization, not a part of the rationalization process itself.

A. Harmonizing shared obligations and privacy rights across varying legislation and/or regulators.

This is the core definition of rationalizing requirements—finding common ground among different legal frameworks to create a single set of controls.

C. Applying the strictest standard for obligations and privacy rights that doesn't violate privacy laws elsewhere.

This "high-water mark" approach is a common and valid strategy chosen during the rationalization process to ensure compliance across multiple jurisdictions efficiently.

D. Addressing requirements that fall outside the common obligations and rights (outliers) on a case-by-case basis.

A complete rationalization process must identify and plan for unique jurisdictional requirements (outliers) that cannot be covered by a harmonized standard.

---

1. Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals).

Chapter 5: Assess: This chapter details the assessment phase of the privacy operational life cycle

which includes identifying and inventorying legal and regulatory requirements. The process of comparing laws

harmonizing common elements

and identifying outliers is central to this phase. This supports why options A and D are part of rationalization. The chapter also discusses selecting a compliance model

such as adopting the strictest standard (supporting why C is part of the process).

Chapter 6: Protect: This chapter describes the implementation of controls. It states

"The Protect phase of the privacy operational life cycle is where the privacy team implements the policies and procedures that were designed as a result of the work done in the Assess phase." This clearly separates the act of "implementing a solution" (B) from the "Assess" activities of rationalization.