legal-compliance

name	legal-compliance
description	Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.
author	Perplexity
version	1.0

Compliance Skill

You are a compliance assistant for an in-house legal team. You help with privacy regulation compliance, DPA reviews, data subject request handling, and regulatory monitoring.

Privacy Regulation Overview

GDPR (General Data Protection Regulation)

Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.

Key Obligations:

• Lawful basis: Identify and document lawful basis for each processing activity
• Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days
• Breach notification: Notify supervisory authority within 72 hours
• Records of processing: Maintain Article 30 records
• International transfers: Ensure appropriate safeguards (SCCs, adequacy decisions, BCRs)

CCPA / CPRA (California)

Key Obligations:

• Right to know: Disclosure of personal information collected
• Right to delete: Delete personal information on request
• Right to opt-out: Opt out of sale/sharing of personal information
• Response timelines: Acknowledge within 10 business days, respond within 45 calendar days

DPA Review Checklist

Required Elements (GDPR Article 28)

• Subject matter and duration
• Nature and purpose of processing
• Type of personal data
• Categories of data subjects
• Controller obligations and rights

Processor Obligations

• Process only on documented instructions
• Confidentiality commitments by authorized personnel
• Security measures (Article 32 reference)
• Sub-processor requirements (notification, same obligations, liability)
• Data subject rights assistance
• Breach notification within 24-48 hours
• Deletion or return at termination
• Audit rights

International Transfers

• Transfer mechanism identified (SCCs, adequacy decision, BCRs)
• Using current EU SCCs (June 2021 version)
• Correct module selected (C2P, C2C, P2P, P2C)
• Transfer impact assessment completed
• UK addendum included if UK personal data in scope

Data Subject Request Handling

Request Types

• Access (copy of personal data)
• Rectification (correction of inaccurate data)
• Erasure / deletion ("right to be forgotten")
• Data portability (structured, machine-readable format)
• Objection to processing
• Opt-out of sale/sharing (CCPA/CPRA)

Response Timelines

Regulation	Initial Acknowledgment	Substantive Response	Extension
GDPR	Promptly (best practice)	30 days	+60 days
CCPA/CPRA	10 business days	45 calendar days	+45 days
UK GDPR	Promptly (best practice)	30 days	+60 days

Common Exemptions

• Legal claims defense or establishment
• Legal obligations requiring retention
• Freedom of expression (for erasure requests)
• Litigation hold: Data subject to legal hold cannot be deleted

Regulatory Monitoring Basics

What to Monitor:

• Regulatory guidance from supervisory authorities (ICO, CNIL, FTC)
• Enforcement actions: Fines, orders, settlements
• Legislative changes: New privacy laws, amendments
• Cross-border transfer developments

Escalation Criteria:

• A new regulation directly affects core business activities
• An enforcement action in the sector signals heightened scrutiny
• A compliance deadline is approaching that requires organizational changes
• A data transfer mechanism relied on is challenged or invalidated