# EU Code of Conduct Workflows

## Workflow 1: Adhering to an Approved Code

1. **Eligibility Assessment**: Confirm organization falls within the code's defined scope
2. **Internal Gap Analysis**: Compare current practices against all code requirements
3. **Remediation**: Address identified gaps to meet code requirements
4. **Self-Assessment Completion**: Complete the code's self-assessment questionnaire
5. **Evidence Portfolio**: Compile evidence for each code requirement
6. **Monitoring Body Application**: Submit adherence application with self-assessment and evidence
7. **Initial Assessment**: Monitoring body reviews application and conducts assessment
8. **Gap Resolution**: Address any issues identified by the monitoring body
9. **Adherence Approval**: Monitoring body approves adherence
10. **Public Registration**: Organization listed in code's adherent register
11. **Ongoing Monitoring**: Submit to periodic compliance assessments

## Workflow 2: Annual Compliance Assessment

1. **Self-Assessment Update**: Update compliance matrix with any changes since last assessment
2. **Evidence Refresh**: Collect current evidence for all code requirements
3. **Incident Report**: Report any code compliance incidents since last assessment
4. **Complaint Summary**: Provide summary of data subject complaints and resolutions
5. **Monitoring Body Assessment**: Participate in annual assessment by monitoring body
6. **Findings Response**: Address any findings from the assessment
7. **Compliance Determination**: Receive annual compliance outcome
8. **Remediation** (if needed): Implement required corrective actions

## Workflow 3: Complaint Handling Under Code

1. **Receipt**: Monitoring body receives data subject complaint about adherent
2. **Acknowledgment**: Monitoring body acknowledges within 5 business days
3. **Preliminary Assessment**: Assess complaint validity within 15 business days
4. **Adherent Notification**: Notify adherent and request response (15 business days)
5. **Investigation**: Monitor body investigates with evidence from both parties
6. **Determination**: Determine whether code infringement occurred
7. **Remediation**: If infringement: require corrective action from adherent
8. **Sanctions**: If non-compliance persists: warning, suspension, or exclusion
9. **Communication**: Inform complainant of outcome within 60 days
10. **DPA Escalation**: Provide information on supervisory authority complaint if requested