# PIA Review and Update Cadence Workflows

## Workflow 1: Continuous Trigger Monitoring
1. DPO office subscribes to regulatory update feeds (EDPB, national SAs, sector regulators).
2. IT change management system feeds DPIA register with technology change notifications.
3. Incident response team notifies DPIA register of breaches and near-misses.
4. Legal team notifies of regulatory changes and enforcement decisions.
5. Processing owners report scope changes through the DPIA change request form.
6. Each trigger is logged, triaged, and assigned to the affected DPIA(s).

## Workflow 2: Scheduled Review Execution
1. DPIA register generates review reminders 30 days before scheduled review dates.
2. Processing owner confirms whether any material changes have occurred since last review.
3. If no changes: brief review confirming processing matches DPIA, signed by processing owner and DPO.
4. If changes detected: full or targeted review per the review process described in SKILL.md.
5. Update DPIA version, change log, and next review date.

## Workflow 3: Version Control
1. Each DPIA change creates a new version file (DPIA-REF-v1.0.md, DPIA-REF-v1.1.md, etc.).
2. Previous versions archived in the document management system with retention of 7 years.
3. Change log maintained as an appendix to the current version.
4. Only the current version is active; previous versions are read-only.

## Workflow 4: Overdue DPIA Escalation
1. DPIA register flags DPIAs overdue for review (past scheduled review date).
2. Day 1-14 overdue: reminder to processing owner and DPO.
3. Day 15-30 overdue: escalation to senior management.
4. Day 30+ overdue: DPO considers whether processing should be suspended until review is completed.
5. Overdue status documented and available for supervisory authority inspection.