regulatory-compliance

name	regulatory-compliance
description	Validate systems and processes against GDPR/CCPA privacy regulations, privacy-by-design principles, ADA/WCAG accessibility standards, data processing agreements (DPAs), and provide compliance checklists with regulatory change monitoring guidance.
version	1.0.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Write","Glob","Grep","Skill"]
agents	["compliance-checker"]
category	Compliance & Legal
tags	["gdpr","ccpa","privacy","wcag","ada","accessibility","dpa","compliance","regulatory"]
error_handling	graceful
streaming	supported
best_practices	["Validate all applicable regulations (GDPR, CCPA, state laws) — not just one","Never report PASS on partial compliance; use CONDITIONAL with remediation tasks","Include specific remediation steps and owning agent for every FAIL/CONDITIONAL","Regulatory landscape changes — always link to authoritative source URLs","Privacy-by-design must be verified at design time, not retrofitted"]
verified	true
lastVerifiedAt	"2026-03-02T00:00:00.000Z"
source	builtin
trust_score	100
provenance_sha	ae2e5e6290bfe9fe

Regulatory Compliance Skill

Overview

Assess systems, processes, and artifacts against major regulatory frameworks:

• GDPR/CCPA — Data privacy compliance for EU and California/US state laws
• Privacy-by-Design — Proactive privacy embedding following Ann Cavoukian's 7 principles
• ADA/WCAG — Web and software accessibility under ADA and WCAG 2.1/2.2 AA standards
• DPA Validation — Data Processing Agreement completeness and correctness checks
• Regulatory Monitoring — Guidance on tracking regulatory changes across jurisdictions

Output is structured as PASS / CONDITIONAL / FAIL with severity-rated findings and actionable remediation tasks.

When to Use

• Before deploying any feature that collects, processes, or stores personal data
• During architecture review for systems touching PII or user data
• When validating third-party vendor agreements and DPAs
• Before launching products in EU, California, or any jurisdiction with active privacy law
• When auditing accessibility compliance for public-facing interfaces
• As part of CI compliance gates for data pipelines and APIs

Iron Laws

1. NEVER report PASS on partial compliance — if any item fails, the result is CONDITIONAL or FAIL; partial compliance masks violations.
2. ALWAYS include remediation tasks with specific owning agents — vague findings don't produce fixes; every FAIL/CONDITIONAL must specify who fixes it and how.
3. NEVER skip multi-jurisdiction check — GDPR, CCPA, and 20+ US state laws may all apply; document scope clearly.
4. ALWAYS verify privacy-by-design at design time — retrofitting privacy after deployment is significantly more costly and less effective.
5. NEVER treat accessibility as optional — ADA/WCAG compliance carries active litigation risk (ADA lawsuits up 37% H1 2025); all public interfaces must be validated.
6. ALWAYS document regulation version and date assessed — regulatory guidance evolves; stamp every report with the regulation version and assessment date.

Workflow

Step 1: Scope Definition

Define which regulations apply to the subject of the assessment:

## Compliance Scope

- Subject: [System / Feature / DPA / Interface being assessed]
- Jurisdictions: [EU / California / Virginia / Colorado / Other states]
 Applicable Regulations:
 [ ] GDPR (EU General Data Protection Regulation)
 [ ] CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)
 [ ] US State Laws (VCDPA, CPA, CTDPA, etc.)
 [ ] ADA / Section 508 (US accessibility)
 [ ] WCAG 2.1/2.2 AA (Web Content Accessibility Guidelines)
 [ ] DPA Review (vendor data processing agreement)
 Personal Data Categories Involved: [list data types]
 Assessment Date: [YYYY-MM-DD]
 Regulation Versions Referenced: [e.g., GDPR as amended 2024, CPRA effective 2023]