A new privacy law takes effect at the start of next calendar year and the project must comply. What should the project manager do next?

The new privacy law is a significant external constraint that impacts the project's scope, cost, schedule, or quality. The project steering committee is responsible for providing overall guidance and making high-level decisions, including those related to major constraints and changes in project direction. Informing them allows for strategic decision-making and resource allocation to address this new requirement. Notifying the legal department is a good step, but it's not the next step for the project manager; the legal department would advise on compliance, but the steering committee needs to be aware of the impact. Telling the product owner to proceed as planned is incorrect as the law is a mandatory compliance requirement. Notifying the project team and creating a spike is premature; the steering committee needs to approve the approach before the team starts work.