Compliance Check

What This Skill Does

This skill runs compliance checks on proposed actions, product features, marketing campaigns, or business initiatives. It's designed for legal and compliance teams to assess regulatory risks. The output should be reviewed by qualified legal professionals.

When to Use

• Assess the compliance of a new referral program.
• Review the compliance of biometric authentication in an app.
• Check data processing compliance with GDPR/CCPA.
• Evaluate the use of customer testimonials in ads.
• Identify applicable regulations and policies.
• Determine required actions for compliance.

Key Features

• Provides a summary of compliance assessment.
• Identifies applicable regulations and policies.
• Lists specific compliance requirements.
• Highlights potential risk areas.
• Recommends actions to mitigate risks.
• Identifies required approvals.

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Run a compliance check on a proposed action, product feature, marketing campaign, or business initiative.

Important: This command assists with legal workflows but does not provide legal advice. Compliance assessments should be reviewed by qualified legal professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.

Usage

/compliance-check $ARGUMENTS

What I Need From You

Describe what you're planning to do. Examples: "We want to launch a referral program with cash rewards" "We're adding biometric authentication to our mobile app" "We need to process EU customer data in our US data center" "Marketing wants to use customer testimonials in ads"

Output

Compliance Check: [Initiative]

Summary

[Quick assessment: Proceed / Proceed with conditions / Requires further review]

Applicable Regulations and Policies

| Regulation/Policy | Relevance | Key

Requirements

| |-------------------|-----------|-----------------| | [GDPR / CCPA / HIPAA / etc.] | [How it applies] | [What you need to do] |

Requirements

Risk Areas

Recommended Actions

[Most important action] [Second priority] [Third priority]

Approvals Needed

Further Review Recommended

[Areas where outside counsel or specialist review is advised]

Privacy Regulation Overview

GDPR (General Data Protection Regulation)

Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.

Key Obligations for In-House Legal Teams: Lawful basis: Identify and document lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task) Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days (extendable by 60 days for complex requests) Data protection impact assessments (DPIAs): Required for processing likely to result in high risk to individuals Breach notification: Notify supervisory authority within 72 hours of becoming aware of a personal data breach; notify affected individuals without undue delay if high risk Records of processing: Maintain Article 30 records of processing activities International transfers: Ensure appropriate safeguards for transfers outside EEA (SCCs, adequacy decisions, BCRs) DPO requirement: Appoint a Data Protection Officer if required (public authority, large-scale processing of special categories, large-scale systematic monitoring)

Common In-House Legal Touchpoints: Reviewing vendor DPAs for GDPR compliance Advising product teams on privacy by design requirements Responding to supervisory authority inquiries Managing cross-border data transfer mechanisms Reviewing consent mechanisms and privacy notices

CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)

Scope: Applies to businesses that collect personal information of California residents and meet revenue, data volume, or data sale thresholds.

Key Obligations: Right to know: Consumers can request disclosure of personal information collected, used, and shared Right to delete: Consumers can request deletion of their personal information Right to opt-out: Consumers can opt out of the sale or sharing of personal information Right to correct: Consumers can request correction of inaccurate personal information (CPRA addition) Right to limit use of sensitive personal information: Consumers can limit use of sensitive PI to specific purposes (CPRA addition) Non-discrimination: Cannot discriminate against consumers who exercise their rights Privacy notice: Must provide a privacy notice at or before collection describing categories of PI collected and purposes Service provider agreements: Contracts with service providers must restrict use of PI to the specified business purpose

Response Timelines: Acknowledge receipt within 10 business days Respond substantively within 45 calendar days (extendable by 45 days with notice)

Other Key Regulations to Monitor

DPA Review Checklist

When reviewing a Data Processing Agreement or Data Processing Addendum, verify the following:

Required Elements (GDPR Article 28)

[ ] Subject matter and duration: Clearly defined scope and term of processing [ ] Nature and purpose: Specific description of what processing will occur and why [ ] Type of personal data: Categories of personal data being processed [ ] Categories of data subjects: Whose personal data is being processed [ ] Controller obligations and rights: Controller's instructions and oversight rights

Processor Obligations

[ ] Process only on documented instructions: Processor commits to process only per controller's instructions (with exception for legal requirements) [ ] Confidentiality: Personnel authorized to process have committed to confidentiality [ ] Security measures: Appropriate technical and organizational measures described (Article 32 reference) [ ] Sub-processor requirements:

• Written authorization requirement (general or specific)
• If general authorization: notification of changes with opportunity to object
• Sub-processors bound by same obligations via written agreement
• Processor remains liable for sub-processor performance [ ] Data subject rights assistance: Processor will assist controller in responding to data subject requests [ ] Security and breach assistance: Processor will assist with security obligations, breach notification, DPIAs, and prior consultation [ ] Deletion or return: On termination, delete or return all personal data (at controller's choice) and delete existing copies unless legal