An organization operating in a multi-cloud environment wants to implement a data retention policy that ensures compliance with multiple regulations, including GDPR and HIPAA. Which of the following is the MOST important first step in creating a data retention policy?