Determine if the organization's privacy program complies with federal and state privacy laws and regulations