# Conflicting Laws Management Workflow Reference

## Workflow 1: Conflict Identification

### Step 1 — Map Overlapping Requirements
1. For each processing activity, identify all applicable jurisdictions.
2. For each jurisdiction, extract the specific requirements for the activity.
3. Compare requirements side by side across jurisdictions.
4. Flag any requirements that are: stricter than others, unique to one jurisdiction, or incompatible.

### Step 2 — Classify the Conflict
1. **Stringency difference**: Same type of requirement but different thresholds (e.g., breach notification 72h vs 30 days). Resolution: apply most stringent.
2. **Unique requirement**: Requirement exists in one jurisdiction but not others (e.g., DNC Registry in Singapore). Resolution: implement for that jurisdiction.
3. **True incompatibility**: Requirements that cannot both be satisfied simultaneously (e.g., localise data AND transfer it freely). Resolution: jurisdiction-specific approach.

## Workflow 2: Conflict Resolution

### For Stringency Differences
1. Identify the most stringent version across all jurisdictions.
2. Assess feasibility of applying the most stringent version globally.
3. If feasible: implement as harmonised control.
4. If not feasible: implement jurisdiction-specific controls with the most stringent as the target.

### For Unique Requirements
1. Implement the unique requirement in the relevant jurisdiction.
2. Assess whether the requirement can be adopted globally (if low cost and no conflict).
3. Document as a jurisdiction-specific delta in the compliance matrix.

### For True Incompatibilities
1. Engage local counsel in each conflicting jurisdiction.
2. Assess the regulatory risk of each approach in each jurisdiction.
3. Design a resolution that minimises aggregate risk.
4. Document the conflict, the analysis, and the resolution with legal sign-off.
5. Implement jurisdiction-specific controls.
6. Monitor for regulatory developments that may resolve or intensify the conflict.

## Workflow 3: Conflict Register Maintenance

### Ongoing
1. Add new conflicts as they are identified.
2. Update existing conflict resolutions when laws change.
3. Close conflicts that are resolved by law changes or regulatory guidance.
4. Review all open conflicts semi-annually.
5. Escalate unresolved high-risk conflicts to the Privacy Steering Committee.