VodouAI Legal Compliance Checker Agent
Overview
This agent guides compliance work across privacy regulations, terms of service, open source licensing, data handling, and security audit preparation. Use it when you need to assess your compliance posture, prepare for an audit, evaluate whether a new feature has compliance implications, or ensure your open source usage is properly licensed.
Important: This agent provides structured frameworks and checklists for compliance work. It is not a substitute for qualified legal counsel. For binding legal decisions, involve a lawyer.
STOPPING POINT 1: What compliance area do you need to address?
- Audit privacy compliance - Review GDPR, CCPA, and other privacy regulation compliance
- Review terms of service - Assess and update terms of service and privacy policy
- Check open source license compliance - Audit open source dependencies for license compatibility
- Assess data handling practices - Review how data is collected, stored, processed, and deleted
- Prepare for a security audit - Get ready for SOC 2, ISO 27001, or customer security questionnaires
Workflow 1: Privacy Compliance Audit
GDPR compliance checklist
GDPR COMPLIANCE AUDIT
Date: [date]
Auditor: [name]
Scope: [what systems/products are covered]
LAWFUL BASIS FOR PROCESSING
- [ ] Each type of data processing has an identified lawful basis
(consent, contract, legitimate interest, legal obligation, vital interest, public task)
- [ ] Lawful basis is documented for each processing activity
- [ ] Where consent is the basis, consent is:
- [ ] Freely given (not bundled with other agreements)
- [ ] Specific (covers defined processing activities)
- [ ] Informed (clear language about what and why)
- [ ] Unambiguous (affirmative action, no pre-checked boxes)
- [ ] Withdrawable (easy to revoke as it was to give)
DATA SUBJECT RIGHTS
- [ ] Right to access: Users can request a copy of their data
Process: [describe how] -- Response time: [must be within 30 days]
- [ ] Right to rectification: Users can correct inaccurate data
Process: [describe how]
- [ ] Right to erasure: Users can request deletion of their data
Process: [describe how] -- Exceptions documented: [list]
- [ ] Right to portability: Users can export their data in machine-readable format
Format: [describe format]
- [ ] Right to object: Users can object to processing based on legitimate interest
Process: [describe how]
- [ ] Right to restrict processing: Users can limit how data is used
Process: [describe how]
DATA PROCESSING RECORDS
- [ ] Record of Processing Activities (ROPA) maintained
- [ ] ROPA includes: purpose, categories of data, categories of data subjects,
recipients, transfers to third countries, retention periods, security measures
DATA PROTECTION
- [ ] Data Protection Impact Assessment (DPIA) conducted for high-risk processing
- [ ] Encryption at rest: [yes/no -- details]
- [ ] Encryption in transit: [yes/no -- TLS version]
- [ ] Access controls: principle of least privilege applied
- [ ] Data minimization: only collecting data that is necessary
INTERNATIONAL TRANSFERS
- [ ] Data transfers outside EU/EEA identified
- [ ] Transfer mechanism in place (Standard Contractual Clauses, adequacy decision, etc.)
- [ ] Transfer impact assessment completed
BREACH NOTIFICATION
- [ ] Breach detection capability in place
- [ ] Breach notification process documented
- [ ] Can notify supervisory authority within 72 hours
- [ ] Can notify affected individuals without undue delay
DATA PROTECTION OFFICER (if required)
- [ ] DPO appointed: [yes/no/not required]
- [ ] DPO contact published: [yes/no]
CCPA compliance checklist
CCPA COMPLIANCE AUDIT
Date: [date]
APPLICABILITY
- [ ] Confirmed whether CCPA applies (annual revenue > $25M, OR data on 100K+
consumers/households, OR 50%+ revenue from selling personal information)
CONSUMER RIGHTS
- [ ] Right to know: Consumers can request what personal info is collected
Verification method: [describe]
Response time: [45 days, extendable to 90]
- [ ] Right to delete: Consumers can request deletion
Process: [describe]
Exceptions: [list any]
- [ ] Right to opt-out of sale: "Do Not Sell My Personal Information" link present
Location: [footer, privacy settings]
- [ ] Right to non-discrimination: Exercising rights does not result in
different pricing or service quality
DISCLOSURE REQUIREMENTS
- [ ] Privacy policy updated within last 12 months
- [ ] Categories of personal information collected are disclosed
- [ ] Categories of sources are disclosed
- [ ] Business purpose for collection is disclosed
- [ ] Categories of third parties with whom info is shared are disclosed
- [ ] Specific pieces of personal information collected are disclosed on request
SERVICE PROVIDER AGREEMENTS
- [ ] All service providers who receive personal information have CCPA-compliant contracts
- [ ] Contracts prohibit selling the data and limit use to the business purpose
STOPPING POINT 2: Privacy audit is complete. What do you need next?
- Create a remediation plan - Prioritize and schedule fixes for identified gaps
- Build a Data Protection Impact Assessment - Conduct a DPIA for a specific feature or system
- Draft or update the privacy policy - Revise privacy policy to address gaps
- Set up ongoing monitoring - Create a recurring compliance check process
- Prepare for a regulatory inquiry - Organize documentation in case of a supervisory authority request
Workflow 2: Terms of Service Review
ToS review checklist
TERMS OF SERVICE REVIEW
Document: [link to current ToS]
Last updated: [date]
Review date: [today]
Reviewer: [name]
ESSENTIAL CLAUSES
- [ ] Service description: Clearly describes what the service provides
- [ ] User obligations: What users agree to do/not do
- [ ] Acceptable use policy: Prohibited activities defined
- [ ] Account terms: Registration, age requirements, account responsibility
- [ ] Payment terms (if applicable): Pricing, billing cycle, refunds, cancellation
- [ ] Intellectual property: Who owns what (user content, platform content)
- [ ] License grant: What rights users grant you over their content
- [ ] License limitations: What rights you grant users over the service
RISK MITIGATION
- [ ] Limitation of liability: Caps on damages
- [ ] Disclaimer of warranties: Service provided "as is" where appropriate
- [ ] Indemnification: User indemnifies platform for misuse
- [ ] Dispute resolution: Arbitration clause or jurisdiction specified
- [ ] Class action waiver (if applicable): Clearly stated
COMPLIANCE ALIGNMENT
- [ ] Privacy: References privacy policy, consistent with actual practices
- [ ] DMCA / copyright: Takedown procedure if hosting user content
- [ ] Accessibility: Statement on accessibility efforts
- [ ] Data portability: Aligned with GDPR/CCPA requirements
OPERATIONAL
- [ ] Modification clause: How and when terms can be changed, notice period
- [ ] Termination: Under what conditions service or account can be terminated
- [ ] Survival clauses: Which terms survive termination
- [ ] Contact information: How to reach the company for legal matters
- [ ] Effective date: Clearly stated
- [ ] Governing law: Jurisdiction specified
READABILITY
- [ ] Written in plain language (aim for 8th grade reading level)
- [ ] Key points summarized at the top or in a FAQ
- [ ] Not hiding important terms in dense paragraphs
When to update ToS
Triggers that require a ToS review:
- New feature that changes how data is collected or used
- Entering a new market or jurisdiction
- Change in business model or pricing
- Adding user-generated content capabilities
- Introducing AI features (training on user data, AI-generated content, etc.)
- Significant security incident
- Regulatory changes in your operating jurisdictions
Workflow 3: Open Source License Compliance
License compatibility matrix
YOUR PROJECT LICENSE: [e.g., MIT, Apache 2.0, proprietary]
Can you use these licenses in your project?
License | In binary | In source | As dependency | Can modify | Notes
------------------|-----------|-----------|---------------|------------|------
MIT | Yes | Yes | Yes | Yes | Very permissive, include notice
Apache 2.0 | Yes | Yes | Yes | Yes | Include notice, state changes
BSD 2/3-Clause | Yes | Yes | Yes | Yes | Include notice
ISC | Yes | Yes | Yes | Yes | Include notice
MPL 2.0 | Careful | Careful | Yes | Yes | Modified files must stay MPL
LGPL 2.1/3.0 | Careful | No | Yes (dynamic) | Yes | Dynamic linking OK, static = caution
GPL 2.0/3.0 | No* | No* | No* | Yes | Copyleft: your code must also be GPL
AGPL 3.0 | No* | No* | No* | Yes | Network copyleft: even SaaS use triggers
SSPL | No | No | No | -- | Not OSI-approved, very restrictive
BSL/BUSL | Varies | Varies | Read terms | Varies | Time-delayed open source, read carefully
Unlicensed | No | No | No | No | No license = all rights reserved
* Unless your project is also GPL/AGPL licensed
Open source audit process
OPEN SOURCE AUDIT: [project name]
Date: [date]
Step 1: Generate dependency list
- Direct dependencies: [count]
- Transitive dependencies: [count]
- Total: [count]
Step 2: Identify licenses for each dependency
Tool used: [license-checker, fossa, snyk, etc.]
License distribution:
MIT: [count] ([%])
Apache 2.0: [count] ([%])
BSD: [count] ([%])
ISC: [count] ([%])
GPL: [count] ([%])
Unknown: [count] ([%])
Step 3: Flag issues
INCOMPATIBLE LICENSES:
- [package]: [license] -- Reason: [why it conflicts] -- Action: [find alternative / get exception]
UNKNOWN LICENSES:
- [package]: No license found -- Action: [check repo, contact maintainer, or replace]
NOTICE REQUIREMENTS:
- [count] packages require attribution/notice in distribution
- Attribution file up to date: [yes/no]
Step 4: Remediation
- [ ] All incompatible licenses resolved (replaced or exception granted)
- [ ] All unknown licenses resolved (license identified or package replaced)
- [ ] Attribution/NOTICE file updated
- [ ] License policy documented for future dependency additions
STOPPING POINT 3: License audit is complete. What action?
- Replace problematic dependencies - Find alternatives for incompatible licenses
- Build the attribution file - Generate NOTICE/ATTRIBUTION file for distribution
- Create a license policy - Document which licenses are approved for future use
- Set up automated checking - Add license checking to CI/CD pipeline
- Review a specific dependency - Deep dive on a particular license question
Workflow 4: Data Handling Assessment
Data flow documentation
DATA FLOW MAP: [system/feature]
DATA COLLECTION:
What data: [specific fields/types]
How collected: [form, API, tracking, third-party]
Consent mechanism: [how user agrees]
Storage location: [where it goes initially]
DATA PROCESSING:
Purpose: [why you process this data]
Systems involved: [which services touch this data]
Third parties: [who else sees this data]
- [Vendor]: [what data] - [purpose] - [DPA in place? yes/no]
- [Vendor]: [what data] - [purpose] - [DPA in place? yes/no]
DATA STORAGE:
Primary storage: [system, location, encrypted? yes/no]
Backups: [system, location, encrypted? yes/no]
Retention period: [how long kept]
Deletion process: [how data is purged after retention]
DATA ACCESS:
Who can access: [roles/teams]
Access controls: [how access is restricted]
Audit logging: [are accesses logged? yes/no]
Data handling checklist
DATA HANDLING ASSESSMENT
Date: [date]
System: [name]
COLLECTION
- [ ] Only collecting data that is necessary for the stated purpose (data minimization)
- [ ] Users informed about what is collected and why (transparency)
- [ ] Consent obtained where required (not relying on implied consent)
- [ ] Sensitive data identified and handled with extra protection
Sensitive categories found: [race, health, financial, biometric, children's data, etc.]
STORAGE
- [ ] Data encrypted at rest
- [ ] Encryption keys managed properly (not stored alongside data)
- [ ] Data classified by sensitivity level
- [ ] Retention periods defined and enforced
- [ ] Data deletion verified (not just soft-deleted or archived indefinitely)
PROCESSING
- [ ] Data used only for stated purpose
- [ ] Processing records maintained
- [ ] Third-party data processing agreements in place
- [ ] Cross-border transfers have appropriate safeguards
ACCESS
- [ ] Principle of least privilege applied
- [ ] Access reviews conducted regularly (quarterly recommended)
- [ ] Service accounts have minimal permissions
- [ ] Admin access requires MFA
- [ ] Access logs maintained and reviewed
SHARING
- [ ] Data shared with third parties only under DPAs
- [ ] Users can see who their data is shared with
- [ ] Opt-out mechanisms work correctly
- [ ] Third parties audited for compliance
Workflow 5: Security Audit Preparation
SOC 2 readiness checklist
SOC 2 READINESS: [Trust Service Criteria]
Preparing for: [Type I (point in time) / Type II (over a period)]
Target audit date: [date]
Scope: [systems and services covered]
SECURITY (required for all SOC 2 audits)
- [ ] Access control policies documented
- [ ] User provisioning and de-provisioning procedures
- [ ] MFA enabled for all production access
- [ ] Network security controls (firewalls, segmentation)
- [ ] Vulnerability management program (scanning, patching)
- [ ] Incident response plan documented and tested
- [ ] Change management process documented
- [ ] Security awareness training for employees
- [ ] Vendor management program
AVAILABILITY (if in scope)
- [ ] SLA/SLO defined and published
- [ ] Uptime monitoring in place
- [ ] Disaster recovery plan documented and tested
- [ ] Capacity planning documented
- [ ] Incident communication procedures
PROCESSING INTEGRITY (if in scope)
- [ ] Input validation controls
- [ ] Data processing accuracy checks
- [ ] Error handling procedures
- [ ] Quality assurance processes
CONFIDENTIALITY (if in scope)
- [ ] Data classification policy
- [ ] Encryption standards documented
- [ ] Confidential data handling procedures
- [ ] NDA/confidentiality agreements with employees and vendors
PRIVACY (if in scope)
- [ ] Privacy policy published and up to date
- [ ] Personal information inventory maintained
- [ ] Data subject rights procedures
- [ ] Privacy impact assessments conducted
- [ ] Data retention and disposal procedures
Security questionnaire preparation
Common questions you will receive from enterprise customers:
SECURITY QUESTIONNAIRE PREP:
AUTHENTICATION AND ACCESS:
Q: How do users authenticate?
A: [describe auth methods, MFA availability, SSO support]
Q: How is administrative access controlled?
A: [describe admin access policies, MFA, audit logging]
Q: How do you handle employee offboarding?
A: [describe deprovisioning process and timeline]
DATA PROTECTION:
Q: Is data encrypted at rest and in transit?
A: [specify encryption methods, key management]
Q: Where is data stored geographically?
A: [list regions/providers]
Q: How long is data retained?
A: [describe retention policies]
Q: Can data be deleted on request?
A: [describe deletion process and timeline]
INCIDENT RESPONSE:
Q: Do you have an incident response plan?
A: [yes/no, when last tested, notification timeline]
Q: Have you experienced a data breach in the last 12 months?
A: [yes/no, details if yes]
COMPLIANCE:
Q: Do you have SOC 2 certification?
A: [Type I/II, date of last report, available on request?]
Q: Are you GDPR compliant?
A: [yes, describe measures]
Q: Do you have a DPA available?
A: [yes/no, link]
INFRASTRUCTURE:
Q: What cloud provider(s) do you use?
A: [list providers and their compliance certifications]
Q: How do you handle vulnerability management?
A: [describe scanning, patching, and remediation processes]
STOPPING POINT 4: Security audit prep is underway. What do you need?
- Gap analysis - Compare current state against SOC 2 requirements and identify what is missing
- Evidence collection - Gather documentation and artifacts the auditor will request
- Policy drafting - Write or update security policies to meet requirements
- Remediation plan - Prioritize and schedule fixes for identified gaps
- Vendor assessment - Evaluate third-party vendors against security requirements