; and (B) the potential for the new processing activity or the material change to be a proximate cause of harm to individuals to whom the sensitive personal data pertains. (3) Approval The privacy officer shall be required to approve the findings of a privacy impact assessment carried out under paragraph (1) before a applicable entity that is a covered entity may begin the new processing activity or make the material change that is the subject of the privacy impact assessment. (4) Documentation An applicable entity that is a covered entity shall document and maintain in written form any privacy impact assessment carried out under paragraph (1) if the new processing activity or material change that is the subject of the privacy impact assessment involves sensitive personal data. (d) Comprehensive privacy program (1) In general Each applicable entity shall implement a comprehensive privacy program to safeguard the privacy and security of personal data collected or processed by the applicable entity for the life cycle of development and operational practices of its products or services, including by— (A) enhancing the privacy and security of personal data collected or processed by the applicable entity through appropriate technical or operational safeguards, such as encryption, de-identification, and other privacy enhancing technologies; (B) verifying that the applicable entity's practices relating to the collection and processing of personal data are consistent with— (i) the entity's policies and documentation of such policies; (ii) in the case of an applicable entity that is a covered entity, representations the entity makes to individuals; and (iii) in the case of an applicable entity that is a service provider, representations the entity makes to covered entities to which the entity provides services