# Multi-Jurisdiction Matrix Workflow Reference

## Workflow 1: Building the Compliance Matrix

### Step 1 — Inventory Jurisdictions
1. Identify all countries where the organisation: is established, has employees, processes personal data, offers goods/services, or monitors behaviour.
2. For each country, identify the primary data protection law and regulator.
3. Assess extraterritorial scope: which laws apply even without local establishment?
4. Prioritise jurisdictions by: data subject volume, revenue, enforcement activity, penalty exposure.

### Step 2 — Map Requirements
1. For each jurisdiction, document requirements across all categories (lawful basis, rights, consent, notice, transfers, DPO, breach, impact assessment, security, retention, penalties, records).
2. Use a structured template with consistent categories across all jurisdictions.
3. Cite specific legal provisions for each requirement.

### Step 3 — Identify Common Requirements
1. Across all jurisdictions, identify requirements that are substantively identical or compatible.
2. These form the baseline controls that satisfy multiple jurisdictions simultaneously.
3. Document the common requirement and the specific provisions it satisfies in each jurisdiction.

### Step 4 — Identify Jurisdiction-Specific Deltas
1. For each jurisdiction, identify requirements not met by the common baseline.
2. Classify deltas as: unique requirements (only in one jurisdiction), stricter thresholds (e.g., shorter timeline), or conflicting requirements (incompatible with another jurisdiction).
3. Document each delta with the specific provision and the divergence from the baseline.

### Step 5 — Design Harmonised Controls
1. For each common requirement, design a single control that meets the most stringent version.
2. For unique requirements, design jurisdiction-specific supplements.
3. For conflicting requirements, design a resolution framework (see conflicting-laws-mgmt skill).
4. Document each control with the jurisdictions it satisfies and any jurisdictional supplements.

## Workflow 2: Maintaining the Matrix

### Quarterly Law Change Review
1. Monitor regulatory developments in all jurisdictions (see privacy-law-monitoring skill).
2. For each change, assess impact on the compliance matrix.
3. Update affected requirements and controls.
4. Communicate changes to regional privacy teams.

### Annual Comprehensive Review
1. Re-assess all jurisdictions for new laws, amendments, and enforcement trends.
2. Conduct a gap analysis between current controls and updated requirements.
3. Prioritise remediation based on risk assessment.
4. Update the harmonised control framework.
5. Present findings to the Privacy Steering Committee.

## Workflow 3: New Jurisdiction Onboarding

### Step 1 — Regulatory Assessment
1. Identify the primary data protection law in the new jurisdiction.
2. Map requirements using the standard matrix template.
3. Compare against the existing harmonised controls.

### Step 2 — Gap Analysis
1. Identify gaps: new requirements not covered by existing harmonised controls.
2. Classify gaps by criticality and remediation complexity.
3. Determine whether gaps can be addressed by extending existing controls or require new jurisdiction-specific controls.

### Step 3 — Implementation
1. Implement required controls before market entry.
2. Update the compliance matrix.
3. Train local staff on jurisdiction-specific requirements.
4. Establish local regulatory monitoring.