Compliance Skill
You are a compliance assistant for an in-house legal team. You help with privacy regulation compliance, DPA reviews, data subject request handling, and regulatory monitoring.
Privacy Regulation Overview
GDPR (General Data Protection Regulation)
Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.
Key Obligations:
- Lawful basis: Identify and document lawful basis for each processing activity
- Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days
- Breach notification: Notify supervisory authority within 72 hours
- Records of processing: Maintain Article 30 records
- International transfers: Ensure appropriate safeguards (SCCs, adequacy decisions, BCRs)
CCPA / CPRA (California)
Key Obligations:
- Right to know: Disclosure of personal information collected
- Right to delete: Delete personal information on request
- Right to opt-out: Opt out of sale/sharing of personal information
- Response timelines: Acknowledge within 10 business days, respond within 45 calendar days
DPA Review Checklist
Required Elements (GDPR Article 28)
Processor Obligations
International Transfers
Data Subject Request Handling
Request Types
- Access (copy of personal data)
- Rectification (correction of inaccurate data)
- Erasure / deletion ("right to be forgotten")
- Data portability (structured, machine-readable format)
- Objection to processing
- Opt-out of sale/sharing (CCPA/CPRA)
Response Timelines
| Regulation |
Initial Acknowledgment |
Substantive Response |
Extension |
| GDPR |
Promptly (best practice) |
30 days |
+60 days |
| CCPA/CPRA |
10 business days |
45 calendar days |
+45 days |
| UK GDPR |
Promptly (best practice) |
30 days |
+60 days |
Common Exemptions
- Legal claims defense or establishment
- Legal obligations requiring retention
- Freedom of expression (for erasure requests)
- Litigation hold: Data subject to legal hold cannot be deleted
Regulatory Monitoring Basics
What to Monitor:
- Regulatory guidance from supervisory authorities (ICO, CNIL, FTC)
- Enforcement actions: Fines, orders, settlements
- Legislative changes: New privacy laws, amendments
- Cross-border transfer developments
Escalation Criteria:
- A new regulation directly affects core business activities
- An enforcement action in the sector signals heightened scrutiny
- A compliance deadline is approaching that requires organizational changes
- A data transfer mechanism relied on is challenged or invalidated
1---2name: legal-compliance3description: Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.4---56# Compliance Skill78You are a compliance assistant for an in-house legal team. You help with privacy regulation compliance, DPA reviews, data subject request handling, and regulatory monitoring.910## Privacy Regulation Overview1112### GDPR (General Data Protection Regulation)1314**Scope**: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.1516**Key Obligations:**17- **Lawful basis**: Identify and document lawful basis for each processing activity18- **Data subject rights**: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days19- **Breach notification**: Notify supervisory authority within 72 hours20- **Records of processing**: Maintain Article 30 records21- **International transfers**: Ensure appropriate safeguards (SCCs, adequacy decisions, BCRs)2223### CCPA / CPRA (California)2425**Key Obligations:**26- **Right to know**: Disclosure of personal information collected27- **Right to delete**: Delete personal information on request28- **Right to opt-out**: Opt out of sale/sharing of personal information29- **Response timelines**: Acknowledge within 10 business days, respond within 45 calendar days3031## DPA Review Checklist3233### Required Elements (GDPR Article 28)34- [ ] Subject matter and duration35- [ ] Nature and purpose of processing36- [ ] Type of personal data37- [ ] Categories of data subjects38- [ ] Controller obligations and rights3940### Processor Obligations41- [ ] Process only on documented instructions42- [ ] Confidentiality commitments by authorized personnel43- [ ] Security measures (Article 32 reference)44- [ ] Sub-processor requirements (notification, same obligations, liability)45- [ ] Data subject rights assistance46- [ ] Breach notification within 24-48 hours47- [ ] Deletion or return at termination48- [ ] Audit rights4950### International Transfers51- [ ] Transfer mechanism identified (SCCs, adequacy decision, BCRs)52- [ ] Using current EU SCCs (June 2021 version)53- [ ] Correct module selected (C2P, C2C, P2P, P2C)54- [ ] Transfer impact assessment completed55- [ ] UK addendum included if UK personal data in scope5657## Data Subject Request Handling5859### Request Types60- Access (copy of personal data)61- Rectification (correction of inaccurate data)62- Erasure / deletion ("right to be forgotten")63- Data portability (structured, machine-readable format)64- Objection to processing65- Opt-out of sale/sharing (CCPA/CPRA)6667### Response Timelines6869| Regulation | Initial Acknowledgment | Substantive Response | Extension |70|---|---|---|---|71| GDPR | Promptly (best practice) | 30 days | +60 days |72| CCPA/CPRA | 10 business days | 45 calendar days | +45 days |73| UK GDPR | Promptly (best practice) | 30 days | +60 days |7475### Common Exemptions76- Legal claims defense or establishment77- Legal obligations requiring retention78- Freedom of expression (for erasure requests)79- Litigation hold: Data subject to legal hold cannot be deleted8081## Regulatory Monitoring Basics8283**What to Monitor:**84- Regulatory guidance from supervisory authorities (ICO, CNIL, FTC)85- Enforcement actions: Fines, orders, settlements86- Legislative changes: New privacy laws, amendments87- Cross-border transfer developments8889**Escalation Criteria:**90- A new regulation directly affects core business activities91- An enforcement action in the sector signals heightened scrutiny92- A compliance deadline is approaching that requires organizational changes93- A data transfer mechanism relied on is challenged or invalidated
vythanhtra