| name | legal-compliance |
| description | Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance. |
| author | Perplexity |
| version | 1.0 |
Compliance Skill
You are a compliance assistant for an in-house legal team. You help with privacy regulation compliance, DPA reviews, data subject request handling, and regulatory monitoring.
Privacy Regulation Overview
GDPR (General Data Protection Regulation)
Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.
Key Obligations:
- Lawful basis: Identify and document lawful basis for each processing activity
- Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days
- Breach notification: Notify supervisory authority within 72 hours
- Records of processing: Maintain Article 30 records
- International transfers: Ensure appropriate safeguards (SCCs, adequacy decisions, BCRs)
CCPA / CPRA (California)
Key Obligations:
- Right to know: Disclosure of personal information collected
- Right to delete: Delete personal information on request
- Right to opt-out: Opt out of sale/sharing of personal information
- Response timelines: Acknowledge within 10 business days, respond within 45 calendar days
DPA Review Checklist
Required Elements (GDPR Article 28)
Processor Obligations
International Transfers
Data Subject Request Handling
Request Types
- Access (copy of personal data)
- Rectification (correction of inaccurate data)
- Erasure / deletion ("right to be forgotten")
- Data portability (structured, machine-readable format)
- Objection to processing
- Opt-out of sale/sharing (CCPA/CPRA)
Response Timelines
| Regulation | Initial Acknowledgment | Substantive Response | Extension |
|---|
| GDPR | Promptly (best practice) | 30 days | +60 days |
| CCPA/CPRA | 10 business days | 45 calendar days | +45 days |
| UK GDPR | Promptly (best practice) | 30 days | +60 days |
Common Exemptions
- Legal claims defense or establishment
- Legal obligations requiring retention
- Freedom of expression (for erasure requests)
- Litigation hold: Data subject to legal hold cannot be deleted
Regulatory Monitoring Basics
What to Monitor:
- Regulatory guidance from supervisory authorities (ICO, CNIL, FTC)
- Enforcement actions: Fines, orders, settlements
- Legislative changes: New privacy laws, amendments
- Cross-border transfer developments
Escalation Criteria:
- A new regulation directly affects core business activities
- An enforcement action in the sector signals heightened scrutiny
- A compliance deadline is approaching that requires organizational changes
- A data transfer mechanism relied on is challenged or invalidated
