Demonstrating that privacy controls operate effectively in practice through testing, monitoring, audits, or independent assessments