compliance-check

A command-style skill that runs a compliance check on a proposed action, product feature, marketing campaign, or business initiative, surfacing applicable regulations, required approvals, and risk areas. It is intended for moments before proceeding: launching a feature that touches personal data, responding when marketing or product proposes something with regulatory implications, or determining which jurisdictional requirements and sign-offs apply. The skill is explicit that it assists with legal workflows but does not provide legal advice, that assessments should be reviewed by qualified legal professionals, and that current requirements must be verified with authoritative sources because regulations change frequently.

Given a plain-language description of the initiative, it produces a structured report: a summary verdict (Proceed, Proceed with conditions, or Requires further review), a table of applicable regulations and policies with their relevance and key requirements, a requirements table tracking met/not met/unknown status and actions needed, a risk-area table with severity and mitigation, prioritized recommended actions, an approvals-needed table, and a section flagging where outside counsel or specialist review is advised.

To ground its assessments, the doc includes a privacy regulation overview covering GDPR (scope, lawful basis, data-subject rights and 30-day response window, DPIAs, 72-hour breach notification, Article 30 records, international transfer safeguards, and DPO requirements) and CCPA/CPRA (consumer rights to know, delete, opt out, correct, and limit sensitive PI use, non-discrimination, privacy notices, service-provider agreements, and response timelines of 10 business days to acknowledge and 45 days to respond). A comparison table summarizes other regimes including LGPD, POPIA, PIPEDA, PDPA, the Australian Privacy Act, PIPL, and UK GDPR. A DPA review checklist enumerates GDPR Article 28 required elements and processor obligations such as documented-instructions processing, confidentiality, security measures, sub-processor authorization and liability, data-subject and breach assistance, deletion or return on termination, audit rights, and breach notification. A note points to CONNECTORS.md for placeholders and connected tools.