A health tech enterprise wants to ensure that its in-house developed mobile app for users complies with data privacy regulations. Which of the following should be identified FIRST when creating an inventory of information systems and data related to the mobile app?

A. Vendors and outsourced systems
B. Data maintained by vendors
C. Information classification scheme
D. Application and data owners