# Direct Collection Information Workflows

## Workflow 1: New Collection Point Setup

```
[New Data Collection Point Identified]
   (web form, app screen, paper form, telephone script, in-person)
         │
         ▼
[Map Data to Be Collected]
   - List each data field
   - Classify category (identity, contact, financial, etc.)
   - Identify whether mandatory or optional
         │
         ▼
[Determine Purpose and Legal Basis for Each Field]
   - Map each field to specific purpose(s)
   - Assign legal basis per purpose
   - If Art. 6(1)(f): document legitimate interest
   - If Art. 6(1)(a): design consent mechanism
         │
         ▼
[Identify Recipients and Transfers]
   - Which third parties will receive this data?
   - Any international transfers?
   - Safeguards in place?
         │
         ▼
[Define Retention Period]
   - Per data category, specify period or criteria
         │
         ▼
[Draft Just-In-Time Notice (Layer 1)]
   - Controller name
   - Purpose(s)
   - Unexpected processing
   - Link to full notice
   - Max 150 words
         │
         ▼
[Verify Full Privacy Notice (Layer 2)]
   - All Art. 13(1)(a)-(f) elements present
   - All Art. 13(2)(a)-(g) elements present
   - Updated for this new collection point
         │
         ▼
[Readability Check]
   - Flesch-Kincaid Grade Level ≤ 8
   - Plain language
   - No unexplained jargon
         │
         ▼
[DPO Review and Approval]
         │
         ▼
[Deploy to Collection Point]
```

## Workflow 2: Privacy Notice Audit for Existing Collection Points

```
[Quarterly Audit Trigger]
         │
         ▼
[Inventory All Active Collection Points]
   - Web forms
   - App screens
   - Paper forms
   - Telephone scripts
   - In-person procedures
         │
         ▼
[For Each Collection Point]
   │
   ├── [Check Layer 1 Presence]
   │     ├── Notice visible? ──► PASS
   │     └── Notice missing? ──► FLAG for remediation
   │
   ├── [Check Art. 13(1) Elements]
   │     └── All 6 elements present? ──► Score
   │
   ├── [Check Art. 13(2) Elements]
   │     └── All 7 elements present? ──► Score
   │
   ├── [Check Timing]
   │     └── Information provided at/before collection? ──► PASS/FAIL
   │
   └── [Check Accuracy]
         └── Is information current and correct? ──► PASS/FAIL
         │
         ▼
[Generate Audit Report]
   - Overall compliance score
   - Per-collection-point scores
   - Gaps identified
   - Remediation actions with deadlines
```

## Workflow 3: Privacy Notice Update Process

```
[Processing Change Triggers Notice Update]
   (new purpose, new recipient, new transfer, new retention period)
         │
         ▼
[Update Full Privacy Notice (Layer 2)]
   - Add/modify relevant section
   - Update "last updated" date
   - Maintain version history
         │
         ▼
[Update Just-In-Time Notices (Layer 1)]
   - If change affects core information at collection point
         │
         ▼
[Readability Re-check]
         │
         ▼
[DPO Approval]
         │
         ▼
[Notify Data Subjects of Material Changes]
   - Email notification for active users
   - Prominent notice on platform
   - 14-day notice period before changes take effect
         │
         ▼
[Deploy Updated Notices]
   - Update all collection points simultaneously
   - Archive previous version
```