Ladies and Gents, what are some areas to look at to get evidence for Rev5 control PT-3(1)?

Attach data tags containing the following purposes to [Assignment: organization-defined elements of personally identifiable information]: [Assignment: organization-defined processing purposes].

How are you all satisfying this control within the environment?