Compliance Check

# /compliance-check -- Compliance Review

> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).

Run a compliance check on a proposed action, product feature, marketing campaign, or business initiative.

**Important**: This command assists with legal workflows but does not provide legal advice. Compliance assessments should be reviewed by qualified legal professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.

## Usage

``` /compliance-check $ARGUMENTS ```

## What I Need From You

Describe what you're planning to do. Examples: - "We want to launch a referral program with cash rewards" - "We're adding biometric authentication to our mobile app" - "We need to process EU customer data in our US data center" - "Marketing wants to use customer testimonials in ads"

## Output

```markdown ## Compliance Check: [Initiative]

### Summary [Quick assessment: Proceed / Proceed with conditions / Requires further review]

### Applicable Regulations and Policies | Regulation/Policy | Relevance | Key Requirements | |-------------------|-----------|-----------------| | [GDPR / CCPA / HIPAA / etc.] | [How it applies] | [What you need to do] |

### Requirements | # | Requirement | Status | Action Needed | |---|-------------|--------|---------------| | 1 | [Requirement] | [Met / Not Met / Unknown] | [What to do] |

### Risk Areas | Risk | Severity | Mitigation | |------|----------|------------| | [Risk] | [High/Med/Low] | [How to address] |

### Recommended Actions 1. [Most important action] 2. [Second priority] 3. [Third priority]

### Approvals Needed | Approver | Why | Status | |----------|-----|--------| | [Person/Team] | [Reason] | [Pending] |

### Further Review Recommended [Areas where outside counsel or specialist review is advised] ```

## Privacy Regulation Overview

### GDPR (General Data Protection Regulation)

**Scope**: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.

**Key Obligations for In-House Legal Teams**: - **Lawful basis**: Identify and document lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task) - **Data subject rights**: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days (extendable by 60 days for complex requests) - **Data protection impact assessments (DPIAs)**: Required for processing likely to result in high risk to individuals - **Breach notification**: Notify supervisory authority within 72 hours of becoming aware of a personal data breach; notify affected individuals without undue delay if high risk - **Records of processing**: Maintain Article 30 records of processing activities - **International transfers**: Ensure appropriate safeguards for transfers outside EEA (SCCs, adequacy decisions, BCRs) - **DPO requirement**: Appoint a Data Protection Officer if required (public authority, large-scale processing of special categories, large-scale systematic monitoring)

**Common In-House Legal Touchpoints**: - Reviewing vendor DPAs for GDPR compliance - Advising product teams on privacy by design requirements - Responding to supervisory authority inquiries - Managing cross-border data transfer mechanisms - Reviewing consent mechanisms and privacy notices

### CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)

**Scope**: Applies to businesses that collect personal information of California residents and meet revenue, data volume, or data sale thresholds.

**Key Obligations**: - **Right to know**: Consumers can request disclosure of personal information collected, used, and shared - **Right to delete**: Consumers can request deletion of their personal information - **Right to opt-out**: Consumers can opt out of the sale or sharing of personal information - **Right to correct**: Consumers can request correction of inaccurate personal information (CPRA addition) - **Right to limit use of sensitive personal information**: Consumers can limit use of sensitive PI to specific purposes (CPRA addition) - **Non-discrimination**: Cannot discriminate against consumers who exercise their rights - **Privacy notice**: Must provide a privacy notice at or before collection describing categories of PI collected and purposes - **Service provider agreements**: Contracts with service providers must restrict use of PI to the specified business purpose

**Response Timelines**: - Acknowledge receipt within 10 business days - Respond substantively within 45 calendar days (extendable by 45 days with notice)

### Other Key Regulations to Monitor

| Regulation | Jurisdiction | Key Differentiators | |---|---|---| | **LGPD** (Brazil) | Brazil | Similar to GDPR; requires DPO appointment; National Data Protection Authority (ANPD) enforcement | | **POPIA** (South