When marketing wants a referral program or product adds biometric auth, /compliance-check tells you which regulations apply before it ships. — Claude Skill

/compliance-check -- Compliance Review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Run a compliance check on a proposed action, product feature, marketing campaign, or business initiative.

Important: This command assists with legal workflows but does not provide legal advice. Compliance assessments should be reviewed by qualified legal professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.

Usage

/compliance-check $ARGUMENTS

What I Need From You

Describe what you're planning to do. Examples:

• "We want to launch a referral program with cash rewards"
• "We're adding biometric authentication to our mobile app"
• "We need to process EU customer data in our US data center"
• "Marketing wants to use customer testimonials in ads"

Output

## Compliance Check: [Initiative]

### Summary
[Quick assessment: Proceed / Proceed with conditions / Requires further review]

### Applicable Regulations and Policies
| Regulation/Policy | Relevance | Key Requirements |
|-------------------|-----------|-----------------|
| [GDPR / CCPA / HIPAA / etc.] | [How it applies] | [What you need to do] |

### Requirements
| # | Requirement | Status | Action Needed |
|---|-------------|--------|---------------|
| 1 | [Requirement] | [Met / Not Met / Unknown] | [What to do] |

### Risk Areas
| Risk | Severity | Mitigation |
|------|----------|------------|
| [Risk] | [High/Med/Low] | [How to address] |

### Recommended Actions
1. [Most important action]
2. [Second priority]
3. [Third priority]

### Approvals Needed
| Approver | Why | Status |
|----------|-----|--------|
| [Person/Team] | [Reason] | [Pending] |

### Further Review Recommended
[Areas where outside counsel or specialist review is advised]

Privacy Regulation Overview

GDPR (General Data Protection Regulation)

Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.

Key Obligations for In-House Legal Teams:

• Lawful basis: Identify and document lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task)
• Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days (extendable by 60 days for complex requests)
• Data protection impact assessments (DPIAs): Required for processing likely to result in high risk to individuals
• Breach notification: Notify supervisory authority within 72 hours of becoming aware of a personal data breach; notify affected individuals without undue delay if high risk
• Records of processing: Maintain Article 30 records of processing activities
• International transfers: Ensure appropriate safeguards for transfers outside EEA (SCCs, adequacy decisions, BCRs)
• DPO requirement: Appoint a Data Protection Officer if required (public authority, large-scale processing of special categories, large-scale systematic monitoring)

CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)

Scope: Applies to businesses that collect personal information of California residents and meet revenue, data volume, or data sale thresholds.

Key Obligations:

• Right to know: Consumers can request disclosure of personal information collected, used, and shared
• Right to delete: Consumers can request deletion of their personal information
• Right to opt-out: Consumers can opt out of the sale or sharing of personal information
• Right to correct: Consumers can request correction of inaccurate personal information (CPRA addition)
• Non-discrimination: Cannot discriminate against consumers who exercise their rights

Response Timelines:

• Acknowledge receipt within 10 business days
• Respond substantively within 45 calendar days (extendable by 45 days with notice)

Other Key Regulations to Monitor

DPA Review Checklist

Required Article 28 elements: subject matter and duration, nature/purpose, types of personal data, categories of data subjects, controller obligations.

Processor obligations: process only on documented instructions, confidentiality, security measures, sub-processor authorization, data subject rights assistance, breach assistance, deletion/return on termination, audit rights, breach notification within 24-48 hours.

International transfers: SCCs (June 2021 version), correct module (C2P/C2C/P2P/P2C), transfer impact assessment, supplementary measures, UK addendum if applicable.

Data Subject Request Handling

Request types: access, rectification, erasure, restriction, portability, objection, opt-out (CCPA/CPRA), limit use of sensitive PI (CPRA).

Response timelines: GDPR 30 days (+60), CCPA/CPRA 45 days (+45), LGPD 15 days.

Common exemptions: legal claims defense, legal obligations requiring retention, public interest, freedom of expression (erasure), litigation hold, regulatory retention periods.

Tips

1. Be specific — "We want to email all our users" is better than "marketing campaign."
2. Include the geography — Compliance requirements vary by jurisdiction.
3. Mention the data — What personal data is involved?