# Privacy Law Monitoring Workflow Reference

## Workflow 1: Daily Monitoring and Triage

### Morning Scan (09:00 local time)
1. Review automated alerts from Tier 1 sources (official gazettes, regulator websites).
2. Review Tier 2 digests (law firm alerts, IAPP dashboard).
3. Identify any new developments requiring triage.

### Triage (within 24 hours of identification)
1. Classify the development using the change classification framework.
2. Assign a preliminary impact score.
3. If Critical or High: immediately notify the escalation chain.
4. If Medium or Low: add to the weekly review agenda.
5. Log the development in the regulatory change register.

## Workflow 2: Impact Assessment

### Step 1 — Scope Assessment (Days 1-3)
1. Identify the geographic scope of the change.
2. Determine which processing activities are affected.
3. Identify which existing controls are impacted.
4. Estimate the data subject volume affected.

### Step 2 — Detailed Impact Scoring (Days 4-7)
1. Score each impact dimension: geographic scope, operational change, data subject volume, enforcement risk, timeline pressure.
2. Calculate the weighted impact score.
3. Categorise: Critical, High, Medium, or Low.
4. Draft the impact assessment summary.

### Step 3 — Review and Approval (Days 8-10)
1. Review the impact assessment with regional DPO(s) for the affected jurisdiction(s).
2. Obtain legal counsel input for Complex or Critical changes.
3. Approve the assessment and distribute per the escalation matrix.
4. Initiate implementation planning for Critical and High changes.

## Workflow 3: Implementation Tracking

### Project Initiation
1. For Critical/High changes: create a dedicated implementation project.
2. Assign project owner, timeline, and resources.
3. Define deliverables (policy update, process change, technical change, training).
4. Set milestones aligned with the legal effective date.

### Execution
1. Execute deliverables per the project plan.
2. Track progress in the GRC platform.
3. Escalate delays or blockers to the CPO.

### Verification and Closure
1. Verify implementation through testing, review, or audit.
2. Update the compliance matrix with the new control.
3. Close the regulatory change register entry.
4. Archive documentation for audit trail.

## Workflow 4: Quarterly Horizon Scan

### Preparation (Week 1 of quarter)
1. Review Tier 3 sources: legislative trackers, policy papers, international developments.
2. Identify upcoming legislation likely to be enacted in the next 12 months.
3. Identify regulatory guidance expected from active regulators.

### Analysis (Week 2)
1. For each identified development, prepare a preliminary impact assessment.
2. Assess whether the existing compliance programme would need changes.
3. Identify any long-lead-time preparations (e.g., infrastructure changes for data localisation).

### Reporting (Week 3)
1. Present the horizon scan to the Privacy Steering Committee.
2. Obtain decisions on: pre-emptive action, resource allocation, or watchlist addition.
3. Update the monitoring plan for the next quarter.

## Workflow 5: Annual Monitoring Programme Review

### Review Scope
1. Assess monitoring coverage: are all relevant jurisdictions covered?
2. Review source effectiveness: are current sources providing timely intelligence?
3. Evaluate metrics: turnaround times, completion rates, missed developments.
4. Benchmark against industry peers and regulatory expectations.

### Update
1. Add new jurisdictions if the organisation has expanded.
2. Upgrade monitoring tools if needed (automated scanning, AI-assisted classification).
3. Update the escalation matrix for organisational changes.
4. Set targets for the next year.