Privacy policies are living documents that reflect how organizations manage personal information. While regular review cycles (e.g., annually) are recommended, nothing restricts updates outside of that cycle when significant changes in processing activities, legal obligations, or identified risks occur.
Therefore, Statement C is incorrect - a privacy policy can and should be updated before the scheduled review if warranted.