Imported from lunaticwithaduck/easytech3d (.claude/skills/compliance/SKILL.md). Install upstream with npx skills add lunaticwithaduck/easytech3d --skill compliance. Copyright stays with the author.

Legal & Compliance Skill

Comprehensive guide for implementing privacy, data protection, and regulatory compliance in web applications. Not legal advice — always consult a qualified attorney for your specific situation.

Compliance Requirements Decision Tree

Where are your users?
├── EU / UK users?
│   └── GDPR applies
│       ├── Processing personal data? → Need lawful basis
│       ├── Using cookies? → Need cookie consent
│       └── Using sub-processors? → Need DPA
├── California users?
│   └── CCPA/CPRA likely applies (if revenue > $25M or data on 100K+ consumers)
├── US healthcare data?
│   └── HIPAA applies
├── Children under 13?
│   └── COPPA applies
└── All users everywhere?
    ├── Need Privacy Policy → Always
    ├── Need Terms of Service → Always
    └── Need Cookie Banner → If using non-essential cookies

What compliance framework do you need?
├── SaaS selling to enterprises?
│   └── SOC 2 Type II (most requested)
├── Healthcare / health data?
│   └── HIPAA + BAA
├── Payment processing?
│   └── PCI DSS (see payments skill)
├── Government contracts?
│   └── FedRAMP
└── General web app?
    └── GDPR + CCPA + basic security practices

GDPR Requirements Checklist

Lawful Basis for Processing

Rights of Data Subjects (Must Implement)

Key Requirements Summary

• Lawful basis documented for each data processing activity
• Privacy policy that's clear and accessible
• Cookie consent with opt-in (not pre-checked)
• Data Processing Agreements with all sub-processors
• Data breach notification within 72 hours to supervisory authority
• Data Protection Officer (if large-scale processing)
• Records of processing activities maintained
• Privacy Impact Assessment for high-risk processing
• All data subject rights are implementable

CCPA / CPRA Requirements Summary

Applies if: Annual revenue > $25M, OR data on 100K+ consumers, OR 50%+ revenue from selling data.

"Do Not Sell" Implementation

// Footer link required by CCPA
<a href="/privacy/do-not-sell">Do Not Sell or Share My Personal Information</a>

// Respect Global Privacy Control (GPC) header
function checkGPC(): boolean {
  if (typeof navigator !== 'undefined') {
    return (navigator as any).globalPrivacyControl === true;
  }
  return false;
}

// If GPC is set, treat as opt-out of sale/sharing
if (checkGPC()) {
  disableThirdPartyTracking();
}

Cookie Consent Implementation

Cookie Categories

Cookie Banner Implementation

// components/CookieConsent.tsx
'use client';

import { useState, useEffect } from 'react';

interface CookiePreferences {
  necessary: true; // Always true
  functional: boolean;
  analytics: boolean;
  marketing: boolean;
}

const CONSENT_KEY = 'cookie-consent';

export function CookieConsent() {
  const [showBanner, setShowBanner] = useState(false);

  useEffect(() => {
    const consent = localStorage.getItem(CONSENT_KEY);
    if (!consent) setShowBanner(true);
  }, []);

  function acceptAll() {
    saveConsent({ necessary: true, functional: true, analytics: true, marketing: true });
  }

  function rejectAll() {
    saveConsent({ necessary: true, functional: false, analytics: false, marketing: false });
  }

  function saveConsent(prefs: CookiePreferences) {
    localStorage.setItem(CONSENT_KEY, JSON.stringify(prefs));
    setShowBanner(false);
    applyConsent(prefs);
  }

  if (!showBanner) return null;

  return (
    <div role="dialog" aria-label="Cookie consent" className="cookie-banner">
      <p>We use cookies to improve your experience. You can customize your preferences.</p>
      <div>
        <button onClick={rejectAll}>Reject All</button>
        <button onClick={() => { /* open preferences modal */ }}>Customize</button>
        <button onClick={acceptAll}>Accept All</button>
      </div>
    </div>
  );
}

function applyConsent(prefs: CookiePreferences) {
  if (prefs.analytics) {
    // Initialize analytics (PostHog, GA, etc.)
  }
  if (prefs.marketing) {
    // Initialize marketing pixels
  }
}

// Helper to check consent status
export function getConsentStatus(): CookiePreferences {
  const stored = localStorage.getItem(CONSENT_KEY);
  if (!stored) return { necessary: true, functional: false, analytics: false, marketing: false };
  return JSON.parse(stored);
}

GDPR Cookie Rules

• No pre-checked boxes — consent must be affirmative action
• Reject must be as easy as Accept — equal prominence
• Granular choices — users can accept some categories, reject others
• Revocable — users can change preferences later
• No cookie walls — don't block content for refusing cookies (debated)

Privacy Policy Essentials

What to Include

1. **Who we are** — Company name, contact, DPO (if applicable)
2. **What data we collect** — List all personal data types
3. **Why we collect it** — Lawful basis for each
4. **How we use it** — Specific purposes
5. **Who we share it with** — Sub-processors list
6. **Where we store it** — Data location (EU/US)
7. **How long we keep it** — Retention periods
8. **Your rights** — Access, deletion, portability, etc.
9. **Cookies** — What cookies and why
10. **Updates** — How we notify of changes
11. **Contact** — How to reach us for data requests

Generator Tools

• Termly — Generates GDPR/CCPA-compliant policies
• Iubenda — Generates policies + cookie consent
• Privacy Policy generators — Starting point, always have a lawyer review

Terms of Service Essentials

Key Sections

Data Subject Rights Implementation

Account Data Export (Right to Access / Portability)

// api/user/export.ts
export async function exportUserData(userId: string) {
  const user = await db.user.findUnique({
    where: { id: userId },
    include: {
      profile: true,
      subscriptions: true,
      notifications: true,
      activityLogs: true,
    },
  });

  if (!user) throw new Error('User not found');

  // Return structured, machine-readable format
  return {
    exportDate: new Date().toISOString(),
    user: {
      email: user.email,
      name: user.name,
      createdAt: user.createdAt,
    },
    profile: user.profile,
    subscriptions: user.subscriptions.map(s => ({
      plan: s.plan,
      status: s.status,
      startDate: s.createdAt,
    })),
    activity: user.activityLogs,
  };
}

Account Deletion (Right to Erasure)

// api/user/delete.ts
export async function deleteUserAccount(userId: string) {
  // 1. Cancel active subscriptions
  await cancelSubscriptions(userId);

  // 2. Delete user data (cascade or manual)
  await db.$transaction([
    db.notification.deleteMany({ where: { userId } }),
    db.activityLog.deleteMany({ where: { userId } }),
    db.session.deleteMany({ where: { userId } }),
    db.subscription.deleteMany({ where: { userId } }),
    db.profile.deleteMany({ where: { userId } }),
    db.user.delete({ where: { id: userId } }),
  ]);

  // 3. Delete from external services
  await deleteFromAnalytics(userId);
  await deleteFromEmailProvider(userId);
  await deleteFromPaymentProvider(userId);

  // 4. Log the deletion (retain minimal audit record)
  await db.auditLog.create({
    data: {
      action: 'ACCOUNT_DELETED',
      entityType: 'USER',
      entityId: userId,
      timestamp: new Date(),
      // Do NOT log PII here
    },
  });
}

Deletion Exceptions

• Legal obligations: Tax records (retain 7 years in most jurisdictions)
• Fraud prevention: Hashed email for ban enforcement
• Audit logs: Keep anonymized records

Data Retention Policy

Retention Schedule Template

Auto-Purge Implementation

// Scheduled job (daily cron)
export async function purgeExpiredData() {
  const now = new Date();

  // Purge old authentication logs (90 days)
  await db.authLog.deleteMany({
    where: { createdAt: { lt: subDays(now, 90) } },
  });

  // Purge old analytics (1 year)
  await db.analyticsEvent.deleteMany({
    where: { createdAt: { lt: subYears(now, 1) } },
  });

  // Anonymize old support tickets (2 years)
  await db.supportTicket.updateMany({
    where: { createdAt: { lt: subYears(now, 2) }, anonymized: false },
    data: { userEmail: 'anonymized', userName: 'anonymized', anonymized: true },
  });
}

Audit Logging

Audit Log Schema

model AuditLog {
  id          String   @id @default(cuid())
  userId      String?  // null for system actions
  action      String   // CREATE, UPDATE, DELETE, LOGIN, EXPORT, etc.
  entityType  String   // USER, SUBSCRIPTION, SETTINGS, etc.
  entityId    String
  changes     Json?    // { field: { old: x, new: y } }
  ipAddress   String?
  userAgent   String?
  timestamp   DateTime @default(now())

  @@index([userId, timestamp])
  @@index([entityType, entityId])
  @@index([action, timestamp])
}

Audit Log Implementation

export async function createAuditLog(params: {
  userId?: string;
  action: string;
  entityType: string;
  entityId: string;
  changes?: Record<string, { old: unknown; new: unknown }>;
  request?: Request;
}) {
  await db.auditLog.create({
    data: {
      userId: params.userId,
      action: params.action,
      entityType: params.entityType,
      entityId: params.entityId,
      changes: params.changes ?? undefined,
      ipAddress: params.request?.headers.get('x-forwarded-for') ?? undefined,
      userAgent: params.request?.headers.get('user-agent') ?? undefined,
    },
  });
}

// Usage
await createAuditLog({
  userId: currentUser.id,
  action: 'UPDATE',
  entityType: 'USER',
  entityId: targetUser.id,
  changes: { role: { old: 'member', new: 'admin' } },
  request: req,
});

What to Log

SOC 2 Basics

What is SOC 2?

SOC 2 is a compliance framework for SaaS companies based on 5 Trust Service Criteria:

Type I vs Type II

Key Controls to Implement

• Access control (RBAC, MFA for team)
• Encryption at rest and in transit
• Audit logging
• Incident response plan
• Vulnerability management (patching, scanning)
• Change management (PR reviews, CI/CD)
• Employee security training
• Vendor management
• Backup and recovery
• Monitoring and alerting

SOC 2 Tools

Accessibility Compliance

Requirements by Region

For detailed accessibility implementation patterns, see the frontend skill.

Quick Compliance Checklist

• All images have alt text
• Keyboard navigation works throughout
• Color contrast meets AA ratio (4.5:1 text, 3:1 large text)
• Form fields have labels
• Focus indicators are visible
• Screen reader compatible (semantic HTML, ARIA where needed)
• No content flashes more than 3 times per second
• Error messages are descriptive and associated with fields

Common Mistakes

Pre-Delivery Checklist

• Privacy policy published and accessible from every page
• Terms of service published and accepted at signup
• Cookie consent banner implemented with opt-in
• Cookie categories properly classified
• Data export (Right to Access) endpoint works
• Account deletion (Right to Erasure) fully cascades
• Data retention periods defined and auto-purge scheduled
• Audit logging implemented for sensitive actions
• Sub-processor list maintained
• CCPA "Do Not Sell" link in footer (if applicable)
• Global Privacy Control (GPC) header respected
• Consent records stored (proof of consent)
• Data encryption at rest and in transit
• Incident response plan documented
• Accessibility basics met (WCAG 2.2 Level AA)
• Legal review completed (not just generated policies)

References

• GDPR Official Text
• CCPA Official Text
• WCAG 2.2
• SOC 2 Overview (AICPA)
• Vanta
• Termly (Policy Generator)