# Compliance

> Framework for regulatory compliance including GDPR, CCPA, employment law, and industry-specific regulations. Use when assessing compliance requirements, drafting policies, or conducting compliance audits.

- Skill: `saolalab/compliance` (Agent Skill)
- Install (CLI): `npx skillmds@latest add saolalab/compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/saolalab/compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: saolalab (https://skillmd.com/u/saolalab)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/saolalab/compliance

---


# Compliance

This skill provides frameworks and checklists for regulatory compliance across multiple jurisdictions and regulations.

## GDPR Compliance Checklist

The General Data Protection Regulation (GDPR) applies to companies processing personal data of EU residents.

### Legal Basis
- [ ] Identified legal basis for each data processing activity (consent, contract, legal obligation, vital interests, public task, legitimate interests)
- [ ] Documented legal basis for each processing activity
- [ ] Consent mechanisms meet GDPR standards (freely given, specific, informed, unambiguous)

### Data Subject Rights
- [ ] Right to access — Process for handling data subject access requests (30-day response time)
- [ ] Right to rectification — Process for correcting inaccurate data
- [ ] Right to erasure ("right to be forgotten") — Process for deleting data upon request
- [ ] Right to restrict processing — Process for limiting how data is used
- [ ] Right to data portability — Process for providing data in machine-readable format
- [ ] Right to object — Process for handling objections to processing
- [ ] Automated decision-making — Procedures for handling automated decisions and profiling

### Data Protection Measures
- [ ] Data Protection Impact Assessment (DPIA) conducted for high-risk processing
- [ ] Privacy by Design and Privacy by Default implemented
- [ ] Data minimization — Only collect necessary data
- [ ] Purpose limitation — Use data only for stated purposes
- [ ] Storage limitation — Delete data when no longer needed
- [ ] Encryption of personal data in transit and at rest
- [ ] Access controls and authentication mechanisms
- [ ] Regular security assessments and audits

### Documentation
- [ ] Records of processing activities maintained
- [ ] Privacy policy updated and GDPR-compliant
- [ ] Data processing agreements (DPAs) with all processors
- [ ] Breach notification procedures documented (72-hour notification requirement)
- [ ] Data Protection Officer (DPO) appointed if required

### Third-Party Processors
- [ ] DPAs executed with all third-party processors
- [ ] Processors meet GDPR requirements
- [ ] Sub-processor approval mechanisms in place
- [ ] Regular audits of processor compliance

## CCPA Compliance Checklist

The California Consumer Privacy Act (CCPA) applies to businesses that meet certain thresholds and process California residents' personal information.

### Consumer Rights
- [ ] Right to know — Process for disclosing what personal information is collected, used, shared, or sold
- [ ] Right to delete — Process for deleting personal information upon request (45-day response time)
- [ ] Right to opt-out — Process for opting out of sale of personal information
- [ ] Right to non-discrimination — No discrimination against consumers who exercise rights

### Notice Requirements
- [ ] Privacy policy includes required CCPA disclosures
- [ ] "Do Not Sell My Personal Information" link on homepage (if applicable)
- [ ] Notice at collection provided when collecting personal information
- [ ] Notice of financial incentive provided if applicable

### Data Inventory
- [ ] Inventory of personal information collected
- [ ] Categories of sources identified
- [ ] Business purposes for collection documented
- [ ] Third parties with whom information is shared identified

### Verification Procedures
- [ ] Process for verifying consumer identity before responding to requests
- [ ] Authorized agent procedures established
- [ ] Response procedures documented (45-day response time, 90-day extension if needed)

### Employee/Contractor Data
- [ ] Notice at collection for employees and contractors
- [ ] Limited exemptions for employee data understood
- [ ] Procedures for handling employee data requests

## Data Processing Agreement Template

```markdown
# Data Processing Agreement

**Controller**: [Company Name]
**Processor**: [Processor Name]
**Effective Date**: [Date]

## 1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person
- "Processing" means any operation performed on Personal Data
- "Controller" means the entity that determines the purposes and means of processing
- "Processor" means the entity that processes Personal Data on behalf of the Controller

## 2. Scope and Purpose
Processor shall process Personal Data solely for the purpose of [specific purpose] and in accordance with Controller's documented instructions.

## 3. Processor Obligations
Processor agrees to:
- Process Personal Data only as instructed by Controller
- Implement appropriate technical and organizational measures to protect Personal Data
- Ensure persons authorized to process Personal Data are bound by confidentiality
- Assist Controller in responding to data subject requests
- Notify Controller without undue delay of any data breach
- Assist Controller in compliance with GDPR/CCPA obligations
- Delete or return Personal Data upon termination

## 4. Sub-Processors
Processor may engage sub-processors with Controller's prior written consent. Processor remains liable for sub-processor compliance.

## 5. Security Measures
Processor shall implement:
- Encryption of Personal Data in transit and at rest
- Access controls and authentication
- Regular security assessments
- Incident response procedures

## 6. Audit Rights
Controller has the right to audit Processor's compliance with this Agreement.

## 7. Term and Termination
This Agreement remains in effect for the duration of the service agreement. Upon termination, Processor shall delete or return all Personal Data.

## 8. Governing Law
This Agreement shall be governed by [Jurisdiction] law.
```

## Privacy Policy Template Structure

```markdown
# Privacy Policy

## 1. Introduction
- Who we are
- Contact information for privacy inquiries
- Effective date and update history

## 2. Information We Collect
- Personal information collected (name, email, etc.)
- Automatically collected information (cookies, IP address, etc.)
- Information from third parties
- Sensitive information (if applicable)

## 3. How We Use Your Information
- Business purposes for processing
- Legal basis for processing (GDPR)
- Marketing communications (opt-in/opt-out)

## 4. How We Share Your Information
- Service providers
- Business transfers
- Legal requirements
- Sale of personal information (CCPA disclosure)

## 5. Your Rights
- Access rights
- Deletion rights
- Correction rights
- Opt-out rights
- How to exercise rights

## 6. Data Security
- Security measures implemented
- Data breach notification procedures

## 7. Data Retention
- How long we retain data
- Criteria for retention periods

## 8. International Transfers
- Cross-border data transfers
- Safeguards for international transfers

## 9. Children's Privacy
- Age restrictions
- COPPA compliance if applicable

## 10. Changes to This Policy
- How we notify of changes
- Continued use after changes

## 11. Contact Us
- Privacy contact information
- Data Protection Officer (if applicable)
```

## Terms of Service Template Structure

```markdown
# Terms of Service

## 1. Acceptance of Terms
- Agreement to terms by using service
- Age requirements
- Authority to bind entity

## 2. Description of Service
- What the service provides
- Features and functionality
- Service modifications

## 3. User Accounts
- Account creation requirements
- Account security obligations
- Account termination

## 4. Acceptable Use
- Permitted uses
- Prohibited activities
- Enforcement mechanisms

## 5. Intellectual Property
- Ownership of service IP
- User content ownership
- License grants
- DMCA takedown procedures

## 6. Payment Terms
- Pricing and fees
- Payment methods
- Refund policy
- Price changes

## 7. Service Availability
- Service levels (if any)
- Maintenance windows
- Disclaimers

## 8. Limitation of Liability
- Liability caps
- Exclusions
- Disclaimers of warranties

## 9. Indemnification
- User indemnification obligations
- Scope of indemnification

## 10. Termination
- Termination rights
- Effect of termination
- Survival clauses

## 11. Dispute Resolution
- Governing law
- Jurisdiction
- Arbitration/litigation provisions

## 12. General Provisions
- Entire agreement
- Modifications
- Severability
- Assignment
- Force majeure
```

## Compliance Audit Template

```markdown
# Compliance Audit: [Regulation/Area]

**Date**: [Date]
**Auditor**: [Name]
**Scope**: [What was audited]

## Audit Objectives
- [ ] Verify compliance with [regulation/requirement]
- [ ] Identify compliance gaps
- [ ] Assess effectiveness of controls
- [ ] Review documentation

## Findings

### Compliant Areas
- [Finding 1]
- [Finding 2]

### Non-Compliant Areas
- [Finding 1] — Risk: [Level] — Remediation: [Action]
- [Finding 2] — Risk: [Level] — Remediation: [Action]

### Recommendations
1. [Recommendation 1]
2. [Recommendation 2]

## Action Plan
- [ ] [Action item 1] — Owner: [Name] — Due: [Date]
- [ ] [Action item 2] — Owner: [Name] — Due: [Date]

## Follow-Up
- Next audit date: [Date]
- Monitoring procedures: [Description]
```

## Regulatory Change Impact Assessment

```markdown
# Regulatory Change Impact Assessment

**Regulation**: [Name of regulation/law]
**Effective Date**: [Date]
**Assessment Date**: [Date]

## Summary of Changes
[Description of what changed in the regulation]

## Impact Analysis
- **High Impact**: [Areas significantly affected]
- **Medium Impact**: [Areas moderately affected]
- **Low Impact**: [Areas minimally affected]

## Current State Assessment
- [ ] Current practices compliant with new requirements
- [ ] Gaps identified: [List gaps]
- [ ] Risk level: [Low / Medium / High]

## Required Actions
- [ ] [Action 1] — Priority: [High / Medium / Low] — Due: [Date]
- [ ] [Action 2] — Priority: [High / Medium / Low] — Due: [Date]

## Resource Requirements
- **Time**: [Estimated hours]
- **Cost**: [Estimated cost]
- **Personnel**: [Who needs to be involved]

## Timeline
- [Phase 1]: [Date range] — [Activities]
- [Phase 2]: [Date range] — [Activities]
- [Phase 3]: [Date range] — [Activities]

## Monitoring
- [ ] Set up monitoring for ongoing compliance
- [ ] Schedule follow-up review: [Date]
```