A privacy solutions engineer is helping a healthcare analytics company build its data life cycle program. The company handles a mix of marketing contact lists, employee HR records, and patient clinical data. Leadership wants a foundational mechanism that will drive consistent handling — such as encryption strength, access restrictions, and retention periods — as each dataset moves through collection, processing, and disposal. What should the engineer establish FIRST to enable these differentiated controls across the data life cycle?