菜单
Software company legal and compliance: GDPR, SOC 2, CCPA, privacy policy, terms of service, data processing agreements, IP protection, open source licensing, regulatory compliance, security certifications, data residency, incident response legal, employment law.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AI/LLM engineering: LLMOps, prompt engineering, model integration, AI safety, production AI systems.
Data engineering: pipelines, data quality, data mesh, data lakehouse, ETL/ELT, streaming architecture.
DevSecOps: supply chain security, SBOMs, policy-as-code, zero-trust, security automation.
Green software engineering: sustainability, carbon-aware computing, energy-efficient architecture, eco-friendly development.
AI/LLM engineering: LLMOps, prompt engineering, model integration, AI safety, production AI systems.
Data engineering: pipelines, data quality, data mesh, data lakehouse, ETL/ELT, streaming architecture.
| name | sdlc-legal-compliance |
| description | Software company legal and compliance: GDPR, SOC 2, CCPA, privacy policy, terms of service, data processing agreements, IP protection, open source licensing, regulatory compliance, security certifications, data residency, incident response legal, employment law. |
| version | 6.0.0-moderate |
| author | Dinoudon |
| license | MIT |
| platforms | ["linux","macos","windows"] |
| metadata | {"hermes":{"tags":["sdlc","legal","compliance","gdpr","soc2","ccpa","privacy","ip","licensing","security-certifications","data-residency","employment-law"],"related_skills":["sdlc-adversarial-review","sdlc-finance-ops","sdlc-gtm-strategy"]}} |
Privacy regulations, security certifications, IP protection, and legal foundations for software companies.
Trigger when user:
Applies to: Any company processing EU residents' data
Key requirements:
1. Lawful basis for processing (consent, contract, legitimate interest)
2. Data minimization (collect only what's needed)
3. Right to access (SAR — Subject Access Request)
4. Right to erasure ("right to be forgotten")
5. Right to data portability (export user data)
6. Data Protection Impact Assessment (DPIA) for high-risk processing
7. Data Protection Officer (DPO) for large-scale processing
8. 72-hour breach notification to supervisory authority
9. Cross-border data transfer mechanisms (SCCs, adequacy decisions)
Penalties: Up to €20M or 4% of global annual revenue (whichever is higher)
Implementation checklist:
□ Map all personal data flows
□ Create Record of Processing Activities (ROPA)
□ Implement consent management (cookie banner, preference center)
□ Build data subject request (DSR) workflow
□ Sign DPAs with all sub-processors
□ Implement data retention policies
□ Train employees on data handling
□ Appoint EU representative (if no EU establishment)
Applies to: Companies with >$25M revenue, >100K consumers, or >50% revenue from selling data
Key rights:
1. Right to know (what data collected, why, shared with whom)
2. Right to delete
3. Right to opt-out of sale/sharing
4. Right to non-discrimination
5. Right to correct inaccurate data
6. Right to limit use of sensitive data
Implementation:
□ "Do Not Sell or Share My Personal Information" link
□ Privacy policy updates (categories, purposes, retention)
□ Consumer request verification process (45-day response)
□ Service provider / contractor agreements
□ Employee training on CCPA procedures
| Law | Jurisdiction | Key Requirement |
|---|---|---|
| PIPEDA | Canada | Consent, access, correction |
| LGPD | Brazil | Similar to GDPR, consent-based |
| POPIA | South Africa | Data subject rights, lawful processing |
| PDPA | Singapore | Consent, purpose limitation |
| APP | Australia | 13 Privacy Principles |
| PIPL | China | Data localization, consent, DPO |
What: Trust Services Criteria audit by independent CPA
Criteria:
1. Security (required): Protection against unauthorized access
2. Availability (optional): System uptime and performance
3. Processing Integrity (optional): System processing accuracy
4. Confidentiality (optional): Protection of confidential info
5. Privacy (optional): Personal data handling
Timeline:
Month 1-2: Readiness assessment (gap analysis)
Month 3-6: Implementation (policies, controls, tooling)
Month 7-12: Observation period (audit collects evidence)
Month 13: Audit report delivered
Cost: $30K-$100K+ (depends on auditor and company size)
Key controls:
□ Access management (RBAC, MFA, access reviews)
□ Change management (code review, deployment approval)
□ Incident response (detection, triage, notification)
□ Risk management (risk register, annual assessment)
□ Vendor management (due diligence, DPAs)
□ Business continuity (backup, DR, testing)
□ Employee security (training, background checks)
□ Encryption (at rest, in transit)
□ Logging and monitoring (audit trails, SIEM)
What: International standard for Information Security Management System (ISMS)
More prescriptive than SOC 2, requires formal ISMS documentation
Annex A: 93 security controls across 4 categories
Certification: Requires accredited auditor, 3-year cycle
Timeline: 6-18 months for initial certification
Cost: $50K-$200K+
When to get: Enterprise customers require it (especially EU/international)
Applies to: Companies handling Protected Health Information (PHI)
Requirements:
□ Business Associate Agreements (BAAs) with all parties
□ Administrative safeguards (policies, training, risk analysis)
□ Physical safeguards (facility access, workstation security)
□ Technical safeguards (access controls, encryption, audit logs)
□ Breach notification (60 days, HHS, affected individuals)
Penalties: $100-$50,000 per violation, up to $1.5M/year per category
Applies to: Companies that process, store, or transmit cardholder data
Levels (based on transaction volume):
Level 1: >6M transactions/year → Annual on-site audit
Level 2: 1-6M → Annual SAQ
Level 3: 20K-1M → Annual SAQ
Level 4: <20K → Annual SAQ
12 Requirements:
1. Install and maintain firewall
2. Do not use vendor-supplied defaults
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data
5. Use and regularly update antivirus
6. Develop secure systems and software
7. Restrict access on need-to-know basis
8. Assign unique ID to each person
9. Restrict physical access
10. Track and monitor all access
11. Regularly test security systems
12. Maintain information security policy
Tip: Use Stripe/Braintree/Adyen → they handle PCI compliance for you
Permissive (do what you want):
MIT: Use, modify, distribute. Include license notice.
Apache 2.0: MIT + patent grant. Include NOTICE file.
BSD 2/3-clause: Similar to MIT, slightly different wording.
Weak Copyleft (share modifications, not whole project):
LGPL: Modifications to the library must be shared. Your code using it doesn't.
MPL 2.0: Modifications to MPL-licensed files must be shared.
Strong Copyleft (share everything):
GPL 2.0/3.0: If you distribute binaries, you must share source.
AGPL 3.0: GPL + network use counts as distribution (SaaS must share source).
Source-available (not true open source):
BSL (Business Source License): Source available, commercial use restricted until change date.
SSPL: Must open-source entire service stack if offering as service.
Elastic License 2.0: Cannot offer as managed service.
Can combine with MIT code:
✅ MIT, Apache 2.0, BSD, LGPL, MPL, GPL, AGPL
Can combine with GPL code:
✅ GPL, AGPL
❌ MIT, Apache 2.0 (one-way: GPL absorbs them)
Can combine with Apache 2.0 code:
✅ Apache 2.0, MIT, BSD, LGPL, MPL, GPL 3.0, AGPL
❌ GPL 2.0 (patent clause conflict)
Key rule: When in doubt, don't mix GPL with permissive licenses.
□ Audit all dependencies (use tools: license-checker, FOSSA, Snyk)
□ Document licenses for all direct and transitive dependencies
□ Ensure no license conflicts with your business model
□ Include license notices in distributions
□ Create THIRD_PARTY_LICENSES file
□ Monitor for license changes in dependencies
□ Have legal review any AGPL/SSPL/BSL dependencies
1. Acceptance of Terms
2. Description of Service
3. Account Registration
4. Acceptable Use Policy
5. Payment Terms (billing, refunds, cancellation)
6. Intellectual Property (your IP, user content, licenses)
7. User Content (ownership, license grant, moderation)
8. Privacy (link to Privacy Policy)
9. Disclaimers (no warranty, as-is)
10. Limitation of Liability (cap at fees paid)
11. Indemnification
12. Termination
13. Governing Law and Dispute Resolution
14. Changes to Terms (notice period)
15. Contact Information
1. What information we collect (personal, usage, device, cookies)
2. How we use information (service, analytics, marketing, legal)
3. How we share information (service providers, legal, business transfers)
4. Data retention (how long, deletion)
5. Your rights (access, delete, correct, portability, opt-out)
6. International transfers (SCCs, adequacy)
7. Security measures
8. Children's privacy (COPPA compliance if applicable)
9. Changes to policy
10. Contact information (DPO if applicable)
Required when: You process personal data on behalf of customers (B2B SaaS)
Key terms:
1. Subject matter, duration, nature of processing
2. Types of personal data and categories of data subjects
3. Obligations of the processor (you)
4. Sub-processor management (list, notification, objection rights)
5. Data security measures
6. Data subject rights assistance
7. Breach notification (72 hours)
8. Audit rights
9. Data deletion/return on termination
10. International transfer mechanisms
1. Patents: Protect inventions (20-year term)
- Software patents: controversial, expensive ($10K-$50K+)
- Defensive patents: protect against trolls
- Prior art search before filing
2. Trademarks: Protect brand names, logos, slogans
- Register with USPTO (domestic) / WIPO (international)
- ™ (unregistered) vs ® (registered)
- Cost: $250-$350 per class (USPTO)
3. Copyright: Protect code, content, creative works
- Automatic upon creation
- Register for statutory damages ($200-$150K per work)
- Work-for-hire: employer owns employee-created work
4. Trade secrets: Protect confidential business info
- NDAs for employees, contractors, partners
- Access controls and need-to-know basis
- Non-compete agreements (varies by jurisdiction)
Employee: Work-for-hire doctrine → Company owns IP created during employment
Contractor: IP ownership NOT automatic → Must have written assignment clause
Contractor agreement must include:
□ Work-for-hire clause OR IP assignment
□ Scope of work definition
□ Confidentiality obligations
□ Non-solicitation (optional)
□ Indemnification
□ Payment terms
□ Governing law
Warning: If contractor agreement is missing IP assignment, the contractor owns the code.
SIG (Standardized Information Gathering): 800+ questions
CAIQ (Cloud Alliance): Cloud-specific questionnaire
VSA (Vendor Security Alliance): Abbreviated questionnaire
Custom: Enterprise-specific questions
Questions cover:
1. Organization security (policies, governance, training)
2. Asset management (inventory, classification)
3. Access control (RBAC, MFA, provisioning)
4. Encryption (at rest, in transit, key management)
5. Operations (logging, monitoring, incident response)
6. Business continuity (backup, DR, RTO/RPO)
7. Compliance (certifications, audits, regulatory)
8. Privacy (data handling, retention, DSR process)
9. Third-party management (sub-processors, vendor risk)
10. Vulnerability management (scanning, patching, pentesting)
1. Create a "trust page" with certifications, policies, status
2. Maintain a living questionnaire response database
3. Map questionnaire questions to SOC 2 controls
4. Use automation tools (Vanta, Drata, Secureframe)
5. Update responses after each audit cycle
6. Be honest — "not yet" is better than "yes" (then failing audit)
Phase 1: Detection & Containment (0-24 hours)
□ Identify scope of breach
□ Contain the breach (isolate systems, revoke access)
□ Preserve evidence (logs, forensic images)
□ Activate incident response team
□ Engage legal counsel
Phase 2: Assessment (24-48 hours)
□ Determine what data was affected
□ Identify affected individuals (count, jurisdictions)
□ Assess risk of harm (identity theft, financial loss)
□ Determine notification obligations
□ Document timeline and actions taken
Phase 3: Notification (48-72 hours)
□ GDPR: Notify supervisory authority within 72 hours
□ Notify affected individuals (without undue delay)
□ Notify law enforcement (if criminal activity)
□ Notify business partners / customers (if their data affected)
□ Prepare public statement (if media attention likely)
Phase 4: Remediation (1-4 weeks)
□ Fix root cause
□ Implement additional controls
□ Offer credit monitoring to affected individuals
□ Update policies and procedures
□ Conduct post-incident review
Phase 5: Lessons Learned (4-8 weeks)
□ Postmortem report
□ Update incident response plan
□ Additional training if needed
□ Regulatory follow-up as required
To Supervisory Authority (GDPR):
- Nature of breach
- Categories and approximate number of individuals affected
- Categories and approximate number of records affected
- Name and contact details of DPO
- Likely consequences of the breach
- Measures taken or proposed to address the breach
To Affected Individuals:
- What happened (plain language)
- What data was involved
- What you're doing about it
- What they should do (password change, monitoring)
- Contact information for questions
1. At-will employment (US): Either party can terminate at any time
2. Non-compete: Restrictive, varies by state (banned in CA, limited in others)
3. Non-solicitation: Cannot recruit former employer's employees/customers
4. Confidentiality: Protect trade secrets and proprietary information
5. IP assignment: Work created during employment belongs to company
6. Arbitration clause: Disputes resolved via arbitration, not court
7. Severance: Terms for termination without cause
International considerations:
EU: Notice periods, severance requirements, works councils
UK: Similar to EU, post-Brexit variations
APAC: Varies significantly by country
IRS 20-Factor Test (simplified):
Behavioral control:
□ Does company control HOW work is done? → Employee
□ Does worker control their own methods? → Contractor
Financial control:
□ Does company provide tools/equipment? → Employee
□ Does worker invest in own tools? → Contractor
□ Is worker paid hourly/salary? → Employee
□ Is worker paid per project? → Contractor
Relationship type:
□ Is there a written contract? → Consider both
□ Does worker receive benefits? → Employee
□ Is relationship ongoing? → Employee
□ Is relationship project-based? → Contractor
Misclassification risk:
- Back taxes + penalties
- Unpaid benefits + overtime
- Class action lawsuits
- IRS audit
SOC 2 Automation:
Vanta: $10K-$30K/year, integrates with 100+ tools
Drata: $10K-$25K/year, continuous monitoring
Secureframe: $8K-$20K/year, fast setup
Sprinto: $5K-$15K/year, startup-friendly
Privacy Management:
OneTrust: Enterprise privacy platform
TrustArc: Privacy compliance management
Ethyca: Automated privacy requests
Transcend: Data mapping + consent management
Security Questionnaires:
Vanta Questionnaire Automation
SecurityScorecard
BitSight
Whistic
Vendor Risk Management:
Vanta
Drata
OneTrust Vendor Risk
Prevalent
Monthly:
□ Access review (who has access to what)
□ Security training completion check
□ Vendor risk review (new vendors)
Quarterly:
□ Policy review and updates
□ Incident response drill
□ Penetration test (external)
□ Board security report
Annually:
□ SOC 2 audit (Type II)
□ Risk assessment
□ Business continuity test
□ Employee security training refresh
□ Vendor security reassessment
□ Privacy policy update
□ Data mapping refresh
GDPR Chapter V requires lawful transfer mechanism:
1. Adequacy Decision:
Countries with adequate protection:
- EU/EEA member states
- UK, Switzerland, Japan, South Korea, Canada (commercial)
- Israel, New Zealand, Uruguay, Argentina
2. Standard Contractual Clauses (SCCs):
- EU Commission approved templates
- Must complete Annex I (parties, transfer details)
- Must complete Annex II (technical/organizational measures)
- Transfer Impact Assessment (TIA) required
3. Binding Corporate Rules (BCRs):
- For multinational groups
- Requires DPA approval
- Takes 12-18 months to obtain
4. Derogations (limited):
- Explicit consent (with caveats)
- Contract performance
- Legal claims
- Important public interest
Practical steps:
1. Map all data flows (processor, sub-processor)
2. Identify transfer mechanism for each flow
3. Execute SCCs with all processors
4. Complete TIAs for high-risk transfers
5. Implement supplementary measures (encryption, pseudonymization)
Country-specific requirements:
Russia (Federal Law 242-FZ):
- Personal data of Russian citizens must be stored in Russia
- Processing can happen abroad, but storage must be local
- Fines: Up to 18M RUB (~$200K) per violation
China (PIPL):
- Critical data must stay in China
- Cross-border transfers require security assessment
- Data localization for CIIOs (Critical Information Infrastructure Operators)
Brazil (LGPD):
- No strict localization requirement
- But international transfers need adequacy or consent
India (DPDP Act):
- Government can notify categories that must stay in India
- Cross-border transfers allowed to approved countries
Practical approach:
- Use regional data centers (AWS, GCP, Azure)
- Implement data residency controls in application
- Provide data export for users in regulated regions
Stage 1: Template Selection
- NDA (mutual or one-way)
- MSA (Master Service Agreement)
- SOW (Statement of Work)
- DPA (Data Processing Agreement)
- Order Form (commercial terms)
Stage 2: Drafting
- Use approved templates
- Legal review for non-standard terms
- Redline tracking (version control)
Stage 3: Negotiation
- Track all changes
- Escalation path for business terms
- Legal approval for liability/indemnity changes
Stage 4: Execution
- DocuSign / HelloSign for e-signatures
- Counter-execution tracking
- Filing in contract management system
Stage 5: Obligation Management
- SLA monitoring
- Renewal tracking (90/60/30 day alerts)
- Compliance verification
- Audit rights exercise
Stage 6: Renewal/Termination
- Auto-renewal notification (30 days)
- Price escalation review
- Performance evaluation
- Offboarding checklist
Limitation of Liability:
- Cap: Typically 12 months of fees paid
- Exclusions: Data breach, IP infringement, gross negligence
- Carve-outs: Confidentiality, indemnification
Indemnification:
- Provider indemnifies: IP infringement, data breach
- Customer indemnifies: Content, misuse, compliance
- Process: Prompt notice, sole control of defense, cooperation
Service Level Agreement:
- Uptime: 99.9% (43.8 min/month downtime)
- Measurement: Monthly, excluding scheduled maintenance
- Credits: 5% per 0.1% below SLA (capped at 30%)
- Response times: P1 (1h), P2 (4h), P3 (8h), P4 (24h)
Termination:
- For convenience: 30-90 days notice
- For cause: Material breach + 30-day cure period
- Effect: Data return (30 days), data deletion (90 days)
- GDPR Official Text: https://gdpr.eu/
- CCPA Official: https://oag.ca.gov/privacy/ccpa
- SOC 2 (AICPA): https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/trustservicescriteria
- ISO 27001: https://www.iso.org/isoiec-27001-information-security.html
- OWASP Legal: https://owasp.org/
- Choose a License: https://choosealicense.com/
- TLDRLegal: https://tldrlegal.com/
- Vanta (SOC 2 automation): https://www.vanta.com/
- Drata (compliance automation): https://www.drata.com/
- Cooley GO (startup legal): https://www.cooleygo.com/
- Gunderson Dettmer (startup law): https://www.gunder.com/
## Step 13: Employment Law
### Employment Agreement Key Terms
At-will employment:
Non-compete:
Non-solicitation:
IP assignment:
Confidentiality:
### Multi-State Employment
Compliance considerations:
Payroll:
Tools:
## Step 14: IP Portfolio Management
### Patent Strategy
What to patent:
What NOT to patent:
Process:
Portfolio management:
### Trademark Registration
Process:
Classes for tech companies:
International:
1. Service description: Features, functionality, SLA, support terms
2. Subscription terms: Term length, pricing, payment, usage limits
3. Data processing: DPA reference, data ownership, security measures
4. Intellectual property: IP ownership, license terms, feedback
5. Limitation of liability: Cap, exclusions, carve-outs
6. Termination: For convenience, for cause, data return/deletion
7. Warranties: Service as described, compliance, no known infringement
8. Indemnification: Provider (IP, data breach), Customer (content, misuse)
Common negotiation points:
Liability cap:
Customer request: Uncapped or 3-5x annual fees
Our position: 12 months of fees
Compromise: 2x annual fees for data breach, 1x for all else
Indemnification scope:
Customer request: Broad indemnification
Our position: Specific to IP infringement and data breach
Compromise: Add gross negligence and willful misconduct
Data portability:
Customer request: Real-time export, all formats
Our position: Standard export on termination
Compromise: Monthly export capability + termination export
SLA credits:
Customer request: Service credits for any downtime
Our position: Credits for downtime exceeding SLA
Compromise: Credits at 5% per 0.1% below SLA (cap 30%)
Audit rights:
Customer request: Annual audit rights
Our position: SOC 2 report sufficient
Compromise: SOC 2 + right to audit on material breach
Principles:
1. Proactive, not reactive
2. Privacy as default setting
3. Privacy embedded into design
4. Full functionality (positive-sum)
5. End-to-end security
6. Visibility and transparency
7. User-centric
Implementation:
Data minimization:
- Collect only what is necessary
- Delete when no longer needed
- Anonymize/pseudonymize where possible
Purpose limitation:
- Document purpose for each data element
- Enforce purpose in code
- Re-consent for new purposes
Consent management:
- Granular consent options
- Easy withdrawal
- Consent records maintained
- Cookie consent management
Tools:
- OneTrust: Privacy management
- TrustArc: Privacy compliance
- Cookiebot: Cookie consent
- BigID: Data discovery and classification
Monthly:
- Review new regulations and guidance
- Update compliance documentation
- Employee training completion check
- Incident review and reporting
Quarterly:
- Risk assessment update
- Policy review and updates
- Vendor compliance review
- Board compliance report
Annually:
- SOC 2 audit
- ISO 27001 surveillance audit
- GDPR compliance review
- Employee training refresh
- Business continuity plan test
- Insurance policy review
Regulatory sources:
- FTC.gov (US privacy enforcement)
- ICO.org.uk (UK GDPR)
- CNIL.fr (French GDPR)
- EDPB.europa.eu (EU guidance)
- NIST.gov (cybersecurity frameworks)
- IAPP.org (privacy professional resources)
At-will employment:
- Either party can terminate at any time
- No guaranteed employment duration
- Exceptions: Implied contract, public policy, good faith
Non-compete:
- Enforceability varies by state
- California: Generally unenforceable
- Other states: Must be reasonable in scope, geography, time
- FTC proposed ban (pending as of 2024)
- Alternative: Non-solicit (more enforceable)
Non-solicitation:
- Cannot solicit company's customers or employees
- Typically 12-24 months
- More enforceable than non-competes
IP assignment:
- Work-for-hire: Company owns all work product
- Prior inventions: Excluded from assignment
- Side projects: May or may not be covered
- State laws vary (CA Labor Code 2870)
Confidentiality:
- Survives termination
- No time limit (trade secrets)
- Exceptions: Public knowledge, independent development
Compliance considerations:
- State-specific wage and hour laws
- Paid sick leave requirements
- Pay transparency laws
- Background check restrictions
- Non-compete enforceability
- Tax withholding and unemployment insurance
Payroll:
- Register in each state where employees reside
- Withhold state income tax (varies by state)
- Unemployment insurance (SUI) registration
- Workers compensation coverage
- State-specific payroll tax filings
Tools:
- Gusto: SMB payroll and HR
- Rippling: HR, IT, finance platform
- Deel: Global payroll and compliance
- Remote: International employment
- Papaya Global: Global payroll management
What to patent:
- Novel technical solutions
- Unique algorithms or processes
- Hardware innovations
- Business methods (limited patentability)
What NOT to patent:
- Trade secrets (better kept secret)
- Software alone (Alice Corp v. CLS Bank)
- Obvious improvements
- Fast-moving technology (patent takes 2-3 years)
Process:
1. Invention disclosure (engineer submits idea)
2. Prior art search (patent attorney)
3. Patentability assessment
4. Provisional application ($1,500-3,000)
5. Non-provisional application ($10,000-15,000)
6. Prosecution (2-3 years)
7. Issuance ($1,000-3,000 issue fee)
8. Maintenance fees (3.5, 7.5, 11.5 years)
Portfolio management:
- Annual patent audit
- Prune low-value patents
- Monitor competitor filings
- Consider defensive publications
- Evaluate licensing opportunities
Process:
1. Trademark search (TESS database)
2. Application filing ($250-350 per class)
3. Examination (3-4 months)
4. Publication for opposition (30 days)
5. Registration (if no opposition)
6. Maintenance (Section 8 and 15 filings)
Classes for tech companies:
- Class 9: Software, apps, downloadable content
- Class 35: Business services, SaaS
- Class 38: Telecommunications
- Class 41: Education, training
- Class 42: Software development, hosting
International:
- Madrid Protocol: Single application for 120+ countries
- National filings: For countries not in Madrid
- Budget: $5,000-20,000 for key markets
Trust Service Criteria:
1. Security (Common Criteria)
- CC1: Control environment
- CC2: Communication and information
- CC3: Risk assessment
- CC4: Monitoring activities
- CC5: Control activities
- CC6: Logical and physical access
- CC7: System operations
- CC8: Change management
- CC9: Risk mitigation
2. Availability
- A1.1: Capacity management
- A1.2: Environmental protections
- A1.3: Recovery procedures
3. Processing Integrity
- PI1.1: Data processing objectives
4. Confidentiality
- C1.1: Confidential information identification
5. Privacy
- P1-P8: Privacy principles (aligned with GDPR)
Audit timeline:
- Type I: 3-6 months (design of controls)
- Type II: 6-12 months (operating effectiveness)
- Annual renewal required
- Auditor: Big 4 or specialized firms (A-LIGN, Coalfire)
Principles:
1. Fairness: No discrimination by protected characteristics
2. Transparency: Explain how AI decisions are made
3. Accountability: Clear ownership of AI outcomes
4. Privacy: Data used for training must be lawful
5. Safety: AI must not cause harm
Risk assessment:
Low risk: Spam filter, recommendation engine
Medium risk: Credit scoring, hiring screening
High risk: Medical diagnosis, autonomous vehicles
EU AI Act requirements:
- High-risk AI: Conformity assessment, CE marking
- Limited risk: Transparency obligations
- Minimal risk: No specific requirements
Practical steps:
1. Inventory all AI/ML models in production
2. Classify risk level per model
3. Implement monitoring for bias/drift
4. Document training data provenance
5. Establish human oversight for high-risk decisions
6. Regular bias audits
7. Incident response plan for AI failures
US company expanding internationally:
Option 1: Branch office
- Simple setup
- No separate legal entity
- Parent company liable for all obligations
- Tax: Income taxed in both countries (with treaty relief)
Option 2: Subsidiary (most common)
- Separate legal entity in foreign country
- Limited liability (parent protected)
- Tax: Local taxation, dividends to parent
- Transfer pricing requirements
Option 3: Partnership/JV
- Local partner provides market access
- Shared control and profits
- Complex governance
- Used for highly regulated markets
Recommended structure:
US parent (C-Corp)
-> Ireland holding company (IP, tax optimization)
-> UK subsidiary (European operations)
-> Singapore subsidiary (APAC operations)
-> Brazil subsidiary (LATAM operations)
Arm's length principle:
Related-party transactions must be priced as if between
independent parties in comparable circumstances
Common intercompany transactions:
- IP license fees (parent to subsidiary)
- Management fees (shared services)
- Goods sold (manufacturing to distribution)
- Loans (intercompany financing)
Documentation requirements:
- Master file (group overview)
- Local file (country-specific transactions)
- Country-by-country report (revenue, tax, employees)
Penalties:
- US: 20-40% penalty on underpayment
- EU: Varies by country, can be significant
- APAC: Increasing enforcement
Tools:
- Thomson Reuters ONESOURCE
- KPMG Transfer Pricing Solutions
- EY Transfer Pricing Navigator
Required:
General liability:
- Covers bodily injury, property damage
- $1-2M per occurrence
- $2-4M aggregate
- Cost: $500-2,000/year
Workers compensation:
- Required in most states
- Covers work-related injuries
- Cost: Varies by state and payroll
Directors and officers (D&O):
- Protects board and executives
- Covers lawsuits, regulatory actions
- $2-5M coverage
- Cost: $5,000-20,000/year
Recommended:
Cyber liability:
- Covers data breaches, ransomware
- $1-5M coverage
- Includes forensics, notification, legal
- Cost: $5,000-25,000/year
Errors and omissions (E&O):
- Covers professional service failures
- $1-5M coverage
- Important for SaaS, consulting
- Cost: $3,000-15,000/year
Employment practices liability (EPLI):
- Covers wrongful termination, discrimination
- $1-5M coverage
- Cost: $3,000-10,000/year
Optional:
Key person insurance:
- Covers loss of key executive
- Company is beneficiary
- Amount: 5-10x executive salary
Business interruption:
- Covers lost revenue during disruption
- Tied to property insurance
- Cost: Varies by revenue and risk
Federal:
- Annual tax return (C-Corp: Form 1120, due April 15)
- Quarterly estimated taxes (Form 941)
- Annual information returns (1099s, W-2s)
- Form D (SEC, if fundraising)
State:
- Annual report (varies by state)
- Franchise tax (Delaware: March 1)
- State income tax (varies)
- Sales tax filings (monthly/quarterly)
- Registered agent renewal
Local:
- Business license renewal
- City/county tax filings
- Zoning compliance (if office)
International:
- VAT returns (monthly/quarterly, EU)
- Annual accounts (UK, EU)
- Transfer pricing documentation
- Country-by-country reporting (if >750M EUR revenue)
Tools:
- Clerky: Formation and compliance
- Stripe Atlas: Formation and banking
- Capbase: Cap table and compliance
- ZenBusiness: Registered agent and compliance
Contract management:
- Ironclad: Contract lifecycle management
- DocuSign CLM: Contract management
- Juro: Contract automation
- SpotDraft: Contract management for startups
Entity management:
- Carta: Cap table and equity
- Pulley: Cap table management
- Clerky: Formation and compliance
- Stripe Atlas: Formation and banking
IP management:
- Anaqua: IP portfolio management
- PatSnap: Patent analytics
- TrademarkNow: Trademark search
- IP.com: Prior art search
Compliance:
- Vanta: SOC 2 automation
- Drata: Compliance monitoring
- OneTrust: Privacy management
- TrustArc: Privacy compliance
Legal research:
- Westlaw: Legal research
- LexisNexis: Legal research
- Casetext: AI legal research
- Law Insider: Contract templates
## Step 26: E-Commerce Legal
### Terms of Service Template
Key sections:
Acceptance of terms
Description of service
User accounts
Acceptable use
Intellectual property
Payment terms
Limitation of liability
Dispute resolution
### E-Commerce Compliance
Consumer protection:
Payment compliance:
Tax compliance:
Tools:
## Step 27: Content and Media Law
### Copyright and Fair Use
Copyright basics:
Fair use factors:
DMCA safe harbor:
Content licensing:
### Trademark Enforcement
Enforcement process:
Monitor for infringement
Cease and desist letter
UDRP (domain disputes)
Litigation (last resort)
## Step 28: Data Privacy Operations
### Data Subject Request Handling
DSR types:
Process:
SLA:
Tools:
### Privacy Impact Assessment
When required:
Assessment steps:
Risk matrix:
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Data breach | Medium | High | Encryption, access controls |
| Unauthorized access | Low | High | MFA, audit logging |
| Data loss | Low | Medium | Backups, redundancy |
| Re-identification | Low | High | Anonymization, pseudonymization |
## Step 29: Legal Operations
### Legal Tech Stack
Contract management:
Legal research:
Entity management:
Compliance:
Billing:
## Step 30: Crisis Management
### Crisis Communication Plan
Crisis types:
Communication team:
Communication channels:
Templates: Initial statement: "We are aware of [issue]. We are investigating and will provide updates every [X hours]."
Update: "We have identified [cause]. We are implementing [fix]. Estimated resolution: [time]."
Resolution: "The issue has been resolved. [Root cause]. [Preventive measures]. We apologize for the inconvenience."
Service description:
- Features and functionality
- Service level agreement (SLA)
- Support terms and response times
- Maintenance windows
Subscription terms:
- Term length (monthly, annual, multi-year)
- Auto-renewal provisions
- Price escalation clauses
- Usage limits and overages
Data terms:
- Data ownership (customer owns their data)
- Data processing (DPA reference)
- Data portability (export on termination)
- Data retention (how long after termination)
IP terms:
- License grant (to use the service)
- Feedback license (customer suggestions)
- Pre-existing IP (each party retains own)
- Work product (if professional services)
Limitation of liability:
- Cap: Typically 12 months of fees
- Exclusions: Data breach, IP infringement, gross negligence
- Consequential damages: Typically excluded
Termination:
- For convenience: 30-90 days notice
- For cause: Material breach + cure period
- Effect: Data return (30 days), data deletion (90 days)
Uptime SLA:
- Target: 99.9% (43.8 min/month downtime)
- Measurement: Monthly, excluding scheduled maintenance
- Credits: 5% per 0.1% below SLA (capped at 30%)
- Reporting: Monthly uptime report
Response time SLA:
- P1 (Critical): 1 hour response, 4 hour resolution
- P2 (High): 4 hour response, 8 hour resolution
- P3 (Medium): 8 hour response, 24 hour resolution
- P4 (Low): 24 hour response, 72 hour resolution
Support SLA:
- Channels: Email, chat, phone (based on tier)
- Hours: 24/7 for enterprise, business hours for standard
- Escalation: Defined escalation path
- Dedicated CSM: For enterprise accounts
Healthcare (HIPAA):
- Business associate agreement (BAA)
- PHI encryption requirements
- Access controls and audit logging
- Breach notification (60 days)
- Annual risk assessment
Financial (SOC 1, PCI DSS):
- SOC 1: Controls over financial reporting
- PCI DSS: Cardholder data protection
- Annual audit
- Quarterly vulnerability scans
- Penetration testing (annual)
Government (FedRAMP, ITAR):
- FedRAMP: Federal cloud security
- ITAR: Export control for defense
- Security assessment (3PAO)
- Continuous monitoring
- Annual authorization
Education (FERPA):
- Student data protection
- Parent consent requirements
- Data sharing restrictions
- Directory information policies
Continuous monitoring:
- Policy compliance checks (automated)
- Access review (quarterly)
- Vulnerability scanning (weekly)
- Penetration testing (annual)
- Audit log review (monthly)
Reporting:
- Compliance dashboard (real-time)
- Risk register (quarterly update)
- Board report (annual)
- Regulatory filing (as required)
Tools:
- Vanta: SOC 2, ISO 27001 automation
- Drata: Continuous compliance
- Lacework: Cloud security
- Prisma Cloud: Multi-cloud security
- Prowler: AWS security
Risk categories:
- Contractual: Breach, disputes, liability
- Regulatory: Non-compliance, fines, sanctions
- IP: Infringement, theft, disputes
- Employment: Discrimination, wrongful termination
- Data: Breach, privacy violations, misuse
- Litigation: Lawsuits, class actions
Risk assessment process:
1. Identify risks (legal team, business stakeholders)
2. Assess likelihood and impact (1-5 scale)
3. Determine risk tolerance (accept, mitigate, transfer, avoid)
4. Implement controls
5. Monitor and review (quarterly)
Risk matrix:
| Risk | Likelihood | Impact | Score | Mitigation |
|------|------------|--------|-------|------------|
| Data breach | 3 | 5 | 15 | Encryption, access controls, insurance |
| IP infringement | 2 | 4 | 8 | Patent search, legal review |
| Employment claim | 2 | 3 | 6 | Training, documentation, insurance |
Stage 1: Request
- Business submits contract request
- Legal triages (template vs custom)
- Assign to appropriate attorney
Stage 2: Drafting
- Use approved templates
- Customize for specific deal
- Legal review of non-standard terms
Stage 3: Negotiation
- Track all changes (redlines)
- Escalation path for business terms
- Legal approval for liability/indemnity
Stage 4: Execution
- E-signature (DocuSign, HelloSign)
- Counter-execution tracking
- Filing in contract repository
Stage 5: Management
- Obligation tracking
- Renewal management (90/60/30 day alerts)
- Performance monitoring
- Compliance verification
Stage 6: Renewal/Termination
- Performance evaluation
- Renegotiation if needed
- Offboarding checklist
Organization:
- By type (customer, vendor, partner, employment)
- By status (active, expired, pending)
- By department (sales, procurement, HR)
- By risk level (high, medium, low)
Metadata:
- Contract ID
- Parties
- Effective date
- Expiration date
- Auto-renewal terms
- Key terms (value, SLA, liability cap)
- Owner (internal)
- Status
Tools:
- Ironclad: CLM platform
- DocuSign CLM: Contract management
- Juro: Contract automation
- ContractWorks: Contract repository
- Agiloft: Enterprise CLM
## Step 35: Employment Law Compliance
### Hiring Compliance
Pre-employment:
Interview compliance:
Offer compliance:
Onboarding compliance:
### Workplace Compliance
Wage and hour:
Anti-discrimination:
Safety:
Leave:
## Step 36: Data Breach Response
### Breach Response Plan
Phase 1: Detection and Containment (0-24 hours) □ Identify scope of breach □ Contain the breach (isolate systems, revoke access) □ Preserve evidence (logs, forensic images) □ Activate incident response team □ Engage legal counsel
Phase 2: Assessment (24-48 hours) □ Determine what data was affected □ Identify affected individuals □ Assess risk of harm □ Determine notification obligations □ Document findings
Phase 3: Notification (48-72 hours) □ Notify affected individuals (if required) □ Notify regulators (GDPR: 72 hours) □ Notify law enforcement (if criminal) □ Prepare public statement (if needed) □ Set up call center/hotline
Phase 4: Remediation (1-4 weeks) □ Implement security improvements □ Offer credit monitoring (if PII exposed) □ Update policies and procedures □ Train employees on lessons learned □ Document response and outcomes
Phase 5: Post-Incident (1-3 months) □ Root cause analysis □ Security audit □ Policy updates □ Training updates □ Regulatory follow-up
### Notification Requirements
GDPR (EU):
CCPA (California):
HIPAA (Healthcare):
State laws:
## Step 37: Legal Technology
### Legal Operations Tools
Contract management:
Legal research:
Entity management:
Compliance:
Billing:
## Related Skills
- [sdlc-finance-ops](sdlc-finance-ops): Software company finance and operations: unit economics, SaaS metrics, fundraising (seed to IPO), fi
- [sdlc-hiring-talent](sdlc-hiring-talent): Technical hiring and team building: recruiting, interview design, coding assessments, system design
- [sdlc-adversarial-review](sdlc-adversarial-review): Multi-agent PR review: 3 specialized reviewers (architecture, security, quality) run in parallel, or