Compliance Check
AnthropicOfficialPublished by Anthropic
- Skill
- Research and analysis
- Business and productivity
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The compliance-check skill provides a structured framework for evaluating the regulatory implications of proposed business actions, product features, or marketing campaigns. It helps users identify applicable regulations, necessary approvals, and potential risk areas. The skill includes detailed reference material on major privacy regulations like GDPR and CCPA, as well as guidance for reviewing Data Processing Agreements (DPAs) and handling data subject requests. It is designed as a preliminary assessment tool to support legal workflows and should always be reviewed by qualified legal professionals.
What it does
- Generates a structured compliance assessment report for proposed initiatives.
- Identifies applicable regulations and policies based on the user's description.
- Outlines specific requirements and potential risk areas for projects.
- Provides a checklist for reviewing Data Processing Agreements (DPAs).
- Offers guidance on handling data subject requests and regulatory monitoring.
- Suggests necessary approvals and recommended actions for compliance.
When to use it
- When launching a new product feature that involves processing personal data.
- Before initiating a marketing campaign with potential regulatory implications.
- When evaluating a new vendor or reviewing a Data Processing Agreement.
- When you need to understand jurisdictional requirements for a business initiative.
- When preparing to respond to a data subject request.
Advantages
- Provides a consistent, structured approach to initial compliance screening.
- Centralizes key information on major global privacy regulations.
- Helps identify potential risks early in the project lifecycle.
- Includes practical checklists for common legal tasks like DPA reviews.
- Encourages proactive engagement with legal teams by providing clear summaries.
Usage examples
- “We want to launch a referral program with cash rewards”
- The agent will analyze the proposal for regulatory implications, identify potential risk areas, and suggest necessary approvals for a referral program.
- “We're adding biometric authentication to our mobile app”
- The agent will flag the high-risk nature of biometric data, list relevant privacy regulations, and outline specific compliance requirements for sensitive data.
- “We need to process EU customer data in our US data center”
- The agent will provide a summary of GDPR requirements for international data transfers and list necessary safeguards like SCCs.
- “Marketing wants to use customer testimonials in ads”
- The agent will identify potential risks regarding consent and data usage, and suggest steps to ensure the campaign meets privacy standards.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/anthropics/compliance-check/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip compliance-check.zip -d .agents/skills
Documentation by Anthropic
/compliance-check -- Compliance Review
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Run a compliance check on a proposed action, product feature, marketing campaign, or business initiative.
Important: This command assists with legal workflows but does not provide legal advice. Compliance assessments should be reviewed by qualified legal professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.
Usage
/compliance-check $ARGUMENTSWhat I Need From You
Describe what you're planning to do. Examples:
"We want to launch a referral program with cash rewards"
"We're adding biometric authentication to our mobile app"
"We need to process EU customer data in our US data center"
"Marketing wants to use customer testimonials in ads"
Output
## Compliance Check: [Initiative]
### Summary
[Quick assessment: Proceed / Proceed with conditions / Requires further review]
### Applicable Regulations and Policies
| Regulation/Policy | Relevance | Key Requirements |
|-------------------|-----------|-----------------|
| [GDPR / CCPA / HIPAA / etc.] | [How it applies] | [What you need to do] |
### Requirements
| # | Requirement | Status | Action Needed |
|---|-------------|--------|---------------|
| 1 | [Requirement] | [Met / Not Met / Unknown] | [What to do] |
### Risk Areas
| Risk | Severity | Mitigation |
|------|----------|------------|
| [Risk] | [High/Med/Low] | [How to address] |
### Recommended Actions
1. [Most important action]
2. [Second priority]
3. [Third priority]
### Approvals Needed
| Approver | Why | Status |
|----------|-----|--------|
| [Person/Team] | [Reason] | [Pending] |
### Further Review Recommended
[Areas where outside counsel or specialist review is advised]Privacy Regulation Overview
GDPR (General Data Protection Regulation)
Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.
Key Obligations for In-House Legal Teams:
Lawful basis: Identify and document lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task)
Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days (extendable by 60 days for complex requests)
Data protection impact assessments (DPIAs): Required for processing likely to result in high risk to individuals
Breach notification: Notify supervisory authority within 72 hours of becoming aware of a personal data breach; notify affected individuals without undue delay if high risk
Records of processing: Maintain Article 30 records of processing activities
International transfers: Ensure appropriate safeguards for transfers outside EEA (SCCs, adequacy decisions, BCRs)
DPO requirement: Appoint a Data Protection Officer if required (public authority, large-scale processing of special categories, large-scale systematic monitoring)
Common In-House Legal Touchpoints:
Reviewing vendor DPAs for GDPR compliance
Advising product teams on privacy by design requirements
Responding to supervisory authority inquiries
Managing cross-border data transfer mechanisms
Reviewing consent mechanisms and privacy notices
CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)
Scope: Applies to businesses that collect personal information of California residents and meet revenue, data volume, or data sale thresholds.
Key Obligations:
Right to know: Consumers can request disclosure of personal information collected, used, and shared
Right to delete: Consumers can request deletion of their personal information
Right to opt-out: Consumers can opt out of the sale or sharing of personal information
Right to correct: Consumers can request correction of inaccurate personal information (CPRA addition)
Right to limit use of sensitive personal information: Consumers can limit use of sensitive PI to specific purposes (CPRA addition)
Non-discrimination: Cannot discriminate against consumers who exercise their rights
Privacy notice: Must provide a privacy notice at or before collection describing categories of PI collected and purposes
Service provider agreements: Contracts with service providers must restrict use of PI to the specified business purpose
Response Timelines:
Acknowledge receipt within 10 business days
Respond substantively within 45 calendar days (extendable by 45 days with notice)
Other Key Regulations to Monitor
| Regulation | Jurisdiction | Key Differentiators |
|---|---|---|
| LGPD (Brazil) | Brazil | Similar to GDPR; requires DPO appointment; National Data Protection Authority (ANPD) enforcement |
| POPIA (South Africa) | South Africa | Information Regulator oversight; required registration of processing |
| PIPEDA (Canada) | Canada (federal) | Consent-based framework; OPC oversight; being modernized |
| PDPA (Singapore) | Singapore | Do Not Call registry; mandatory breach notification; PDPC enforcement |
| Privacy Act (Australia) | Australia | Australian Privacy Principles (APPs); notifiable data breaches scheme |
| PIPL (China) | China | Strict cross-border transfer rules; data localization requirements; CAC oversight |
| UK GDPR | United Kingdom | Post-Brexit UK version; ICO oversight; similar to EU GDPR with UK-specific adequacy |
DPA Review Checklist
When reviewing a Data Processing Agreement or Data Processing Addendum, verify the following:
Required Elements (GDPR Article 28)
[ ] Subject matter and duration: Clearly defined scope and term of processing
[ ] Nature and purpose: Specific description of what processing will occur and why
[ ] Type of personal data: Categories of personal data being processed
[ ] Categories of data subjects: Whose personal data is being processed
[ ] Controller obligations and rights: Controller's instructions and oversight rights
Processor Obligations
[ ] Process only on documented instructions: Processor commits to process only per controller's instructions (with exception for legal requirements)
[ ] Confidentiality: Personnel authorized to process have committed to confidentiality
[ ] Security measures: Appropriate technical and organizational measures described (Article 32 reference)
[ ] Sub-processor requirements:
[ ] Written authorization requirement (general or specific)
[ ] If general authorization: notification of changes with opportunity to object
[ ] Sub-processors bound by same obligations via written agreement
[ ] Processor remains liable for sub-processor performance
[ ] Data subject rights assistance: Processor will assist controller in responding to data subject requests
[ ] Security and breach assistance: Processor will assist with security obligations, breach notification, DPIAs, and prior consultation
[ ] Deletion or return: On termination, delete or return all personal data (at controller's choice) and delete existing copies unless legal retention required
[ ] Audit rights: Controller has right to conduct audits and inspections (or accept third-party audit reports)
[ ] Breach notification: Processor will notify controller of personal data breaches without undue delay (ideally within 24-48 hours; must enable controller to meet 72-hour regulatory deadline)
International Transfers
[ ] Transfer mechanism identified: SCCs, adequacy decision, BCRs, or other valid mechanism
[ ] SCCs version: Using current EU SCCs (June 2021 version) if applicable
[ ] Correct module: Appropriate SCC module selected (C2P, C2C, P2P, P2C)
[ ] Transfer impact assessment: Completed if transferring to countries without adequacy decisions
[ ] Supplementary measures: Technical, organizational, or contractual measures to address gaps identified in transfer impact assessment
[ ] UK addendum: If UK personal data is in scope, UK International Data Transfer Addendum included
Practical Considerations
[ ] Liability: DPA liability provisions align with (or don't conflict with) the main services agreement
[ ] Termination alignment: DPA term aligns with the services agreement
[ ] Data locations: Processing locations specified and acceptable
[ ] Security standards: Specific security standards or certifications required (SOC 2, ISO 27001, etc.)
[ ] Insurance: Adequate insurance coverage for data processing activities
Common DPA Issues
| Issue | Risk | Standard Position |
|---|---|---|
| Blanket sub-processor authorization without notification | Loss of control over processing chain | Require notification with right to object |
| Breach notification timeline > 72 hours | May prevent timely regulatory notification | Require notification within 24-48 hours |
| No audit rights (or audit rights only via third-party reports) | Cannot verify compliance | Accept SOC 2 Type II + right to audit upon cause |
| Data deletion timeline not specified | Data retained indefinitely | Require deletion within 30-90 days of termination |
| No data processing locations specified | Data could be processed anywhere | Require disclosure of processing locations |
| Outdated SCCs | Invalid transfer mechanism | Require current EU SCCs (2021 version) |
Data Subject Request Handling
Request Intake
When a data subject request is received:
Identify the request type:
Access (copy of personal data)
Rectification (correction of inaccurate data)
Erasure / deletion ("right to be forgotten")
Restriction of processing
Data portability (structured, machine-readable format)
Objection to processing
Opt-out of sale/sharing (CCPA/CPRA)
Limit use of sensitive personal information (CPRA)
Identify applicable regulation(s):
Where is the data subject located?
Which laws apply based on your organization's presence and activities?
What are the specific requirements and timelines?
Verify identity:
Confirm the requester is who they claim to be
Use reasonable verification measures proportionate to the sensitivity of the data
Do not require excessive documentation
Log the request:
Date received
Request type
Requester identity
Applicable regulation
Response deadline
Assigned handler
Response Timelines
| Regulation | Initial Acknowledgment | Substantive Response | Extension |
|---|---|---|---|
| GDPR | Not specified (best practice: promptly) | 30 days | +60 days (with notice) |
| CCPA/CPRA | 10 business days | 45 calendar days | +45 days (with notice) |
| UK GDPR | Not specified (best practice: promptly) | 30 days | +60 days (with notice) |
| LGPD | Not specified | 15 days | Limited extensions |
Exemptions and Exceptions
Before fulfilling a request, check whether any exemptions apply:
Common exemptions across regulations:
Legal claims defense or establishment
Legal obligations requiring retention
Public interest or official authority
Freedom of expression and information (for erasure requests)
Archiving in the public interest or scientific/historical research
Organization-specific considerations:
Litigation hold: Data subject to a legal hold cannot be deleted
Regulatory retention: Financial records, employment records, and other categories may have mandatory retention periods
Third-party rights: Fulfilling the request might adversely affect the rights of others
Response Process
Gather all personal data of the requester across systems
Apply any exemptions and document the basis
Prepare response: fulfill the request or explain why (in whole or part) it cannot be fulfilled
If denying (in whole or part): cite the specific legal basis for denial
Inform the requester of their right to lodge a complaint with the supervisory authority
Document the response and retain records of the request and response
Regulatory Monitoring Basics
What to Monitor
Maintain awareness of developments in:
Regulatory guidance: New or updated guidance from supervisory authorities (ICO, CNIL, FTC, state AGs, etc.)
Enforcement actions: Fines, orders, and settlements that signal regulatory priorities
Legislative changes: New privacy laws, amendments to existing laws, implementing regulations
Industry standards: Updates to ISO 27001, SOC 2, NIST frameworks, and sector-specific requirements
Cross-border transfer developments: Adequacy decisions, SCC updates, data localization requirements
Monitoring Approach
Subscribe to regulatory authority communications (newsletters, RSS feeds, official announcements)
Track relevant legal publications for analysis of new developments
Review industry association updates for sector-specific guidance
Maintain a regulatory calendar of known upcoming deadlines, effective dates, and compliance milestones
Brief the legal team on material developments that affect the organization's processing activities
Escalation Criteria
Escalate regulatory developments to senior counsel or leadership when:
A new regulation or guidance directly affects the organization's core business activities
An enforcement action in the organization's sector signals heightened regulatory scrutiny
A compliance deadline is approaching that requires organizational changes
A data transfer mechanism the organization relies on is challenged or invalidated
A regulatory authority initiates an inquiry or investigation involving the organization
Tips
Be specific — "We want to email all our users" is better than "marketing campaign."
Include the geography — Compliance requirements vary by jurisdiction.
Mention the data — What personal data is involved? This drives most compliance requirements.
Files
- ATTRIBUTION.mdAdded by AutoGineer916 B
- LICENSELicence file added by AutoGineer11.1 KiB
- SKILL.md14.3 KiB
LICENSE
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Requirements and compatibility
Written for: Claude Code, Claude apps
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Claude Code frontmatter
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Anthropic
- Publisher
- Anthropic (Official)
- Source
- anthropics/knowledge-work-plugins · legal/skills/compliance-check · commit e050c2e
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from legal/LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Anthropic.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download compliance-check.zip