Compliance
Privacy, data protection and regulatory checklists for small organisations.
Download all 50
- Answer a security questionnaire
Drafts answers to a customer's security or vendor due-diligence questionnaire strictly from documented practices, citing evidence for each answer and marking gaps instead of overclaiming.
- Assess EU AI Act obligations
Maps an AI system to the EU AI Act's risk categories and roles such as provider or deployer, and lists the likely obligations and application dates to verify with counsel.
- Assess children's privacy obligations
Checks whether an app, site, game or service is likely used by children and what that triggers - age assurance, parental consent, defaults, profiling limits - with the design changes to make.
- Assess an employee monitoring plan
Reviews a plan to monitor staff email, devices, location, calls or productivity for necessity, proportionality, transparency and consultation duties, and suggests a less intrusive design.
- Assess an international data transfer
Checks whether sending personal data to a supplier or team in another country needs a transfer mechanism, which one may fit, the risk assessment to document and the supplementary measures to consider.
- Check whether NIS2 applies to you
Checks whether an organisation falls under the EU NIS2 cybersecurity directive as an essential or important entity, and lists its risk management, incident reporting, registration and board duties.
- Check which US state privacy laws apply
Checks which US state consumer privacy laws likely apply to a business from its revenue, data volumes and data uses, and lists the notice, rights, opt-out, sensitive data and contract duties.
- Audit a product for data protection
Audits a software product, its code and processes against data protection expectations such as GDPR and CCPA, with a pass, partial or gap status per requirement and the product change each gap needs.
- Audit a website's privacy compliance
Checks a website's cookie banner, consent, privacy notice, forms and trackers against common privacy-law expectations and lists prioritised fixes to confirm with a privacy professional.
- Build a compliance calendar
Turns a small organisation's recurring legal and regulatory duties - filings, renewals, reviews, tests, training and reports - into a dated calendar with owners, lead times and evidence to keep.
- Build a compliance readiness checklist
Builds a readiness checklist for a named regulation or framework applied to a specific business, covering applicability, evidence, owners, priorities and points to verify with counsel.
- Check ad and packaging claims before publishing
Checks advertising, packaging and website claims - green, health, price, comparative, "best" and "free" - for evidence and misleading-ad risk, and suggests safer wording.
- Check a subscription's auto-renewal compliance
Checks a subscription's sign-up, free trial, renewal reminders, price-rise notices and cancellation flow against automatic-renewal and easy-cancellation rules, with fixes ranked by risk.
- Check call and meeting recording compliance
Checks a plan to record phone calls, video meetings or AI note-taker transcripts against consent and notice rules where both sides are, and sets announcements, retention and access rules.
- Check email and SMS marketing compliance
Checks an email or SMS marketing programme against consent and content rules such as GDPR, ePrivacy, CAN-SPAM and CASL for each market, and lists concrete fixes ranked by risk.
- Check endorsement disclosures
Checks influencer, affiliate and endorsement content against advertising disclosure expectations for the market and platform, flags hidden or unclear disclosures, and suggests compliant wording.
- Check whether your export needs a licence
Works out whether exporting a product, software or technology may need an export licence - classification, destination, end user and end use - with red flags, records and when to get specialist help.
- Check the legal steps before your first employee
Lists the employment-law steps before a business's first employee starts - registration, contract, right-to-work checks, insurance, pensions, notices, safety and records - in order, to verify locally.
- Check whether HIPAA applies to you
Works out whether a US practice, vendor or health app is a HIPAA covered entity, a business associate or neither, and lists the privacy, security, breach and contract duties that follow.
- Audit an online shop against consumer law
Audits an online shop's product pages, checkout and order emails against consumer rules - pre-contract information, price display, order button, cancellation rights and returns - with a fix list.
- Check what must go on a product label
Lists the mandatory label information for a food, cosmetic, textile, toy or electrical product in a given market, with layout and language rules, claims to avoid and gaps in your draft label.
- Check telemarketing and cold-calling compliance
Checks a sales calling or automated-call campaign against do-not-call registers, consent rules, calling hours, caller ID and script disclosures for each market, with fixes ranked by risk.
- Check your website's accessibility obligations
Works out which accessibility laws likely apply to a website or app - such as the ADA or the European Accessibility Act - the standard expected, deadlines, exemptions and evidence to keep.
- Choose a lawful basis for each data use
Picks the GDPR-style lawful basis for each purpose you process personal data for, with reasons, extra conditions for sensitive data, and what each choice commits you to.
- Work out your PCI DSS scope
Maps how a small merchant takes card payments to find which PCI DSS self-assessment questionnaire likely applies, what is in scope, and how to shrink scope before filling it in.
- Check who is entitled to overtime and minimum wage
Checks role by role whether staff are exempt from overtime and minimum wage rules or entitled to them, testing pay, duties and hours, with records to keep and back-pay exposure.
- Compliance officer
Acts as a pragmatic compliance officer for small organisations who reads obligations closely, turns them into proportionate controls with evidence, and escalates interpretation to counsel.
- Draft a data processing agreement for your customers
Drafts the data processing agreement a SaaS or service provider offers its business customers - instructions, security annex, subprocessors, transfers, breach notice, audits and deletion.
- Draft a data protection impact assessment
Drafts a data protection impact assessment for a project, covering screening, the processing, necessity, risks to people by likelihood and severity, mitigations and residual risk.
- Handle a personal data request
Guides a small organisation through answering a personal-data access or deletion request, covering identity checks, where to search, exemptions to check, deadlines and the reply.
- Handle a police or government data request
Guides a small organisation through a police, court or government request for customer or staff data, checking authenticity and legal basis, disclosing only what is needed and keeping a record.
- Map personal data processing
Drafts a record of personal-data processing activities from business processes, listing purposes, data categories, recipients, transfers, retention and open questions for privacy review.
- Plan CCTV data compliance
Sets up a shop, office, rental or community building's CCTV so it respects privacy rules, covering purpose, camera placement, audio, signs, retention, access, footage requests and a short policy.
- Plan customer due diligence checks
Designs the client onboarding checks for a small regulated firm - identity, beneficial owners, purpose, source of funds and when to escalate - as a step-by-step procedure with records to keep.
- Plan a personal data breach response
Plans a small organisation's personal data breach response covering containment, risk assessment, notification thresholds and deadlines to verify, notice templates and a breach log.
- Plan product safety conformity marking
Works out which product safety rules and conformity marks, such as CE or UKCA, may apply to a physical product a small maker sells, and the technical file, tests, labels and declarations to prepare.
- Plan staff compliance training
Plans a year of role-based compliance training for a small organisation - who needs which topic, how often, in what format - with completion records an inspector or client would accept.
- Plan ISO 27001 certification readiness
Plans a small organisation's route to ISO 27001 certification - scope, gap assessment, risk method, Statement of Applicability, required records, internal audit and choosing a certification body.
- Small organisation privacy programme track
Sets up a proportionate privacy programme for a small organisation in five gated steps - data inventory, lawful bases and notices, vendors and transfers, rights and breaches, retention and upkeep.
- Respond to a regulator inquiry
Helps a small organisation answer a letter from a data protection or other regulator about a complaint or concern, with a fact-finding plan, an accurate response, remedial actions and a document list.
- Review a vendor data processing agreement
Reviews a SaaS vendor's data processing agreement against core requirements such as instructions, security, subprocessors, transfers, breach notice, audits and deletion, and lists the gaps to raise.
- Run a legitimate interests assessment
Works through the three-part purpose, necessity and balancing test for relying on legitimate interests to process personal data, records the reasoning and names the safeguards that tip the balance.
- Run due diligence on a new vendor
Assesses a new software or service vendor before onboarding for data protection, security, continuity and contract risk, scaled to its data and access, with questions and a go or no-go record.
- Set up a gifts and hospitality register
Sets anti-bribery rules for gifts and hospitality given or received - approval thresholds, red flags like public officials or pending decisions - with a register template and a decision guide.
- Set up sanctions screening
Designs a proportionate sanctions screening process for a small business that onboards customers, suppliers or shipments abroad, covering lists, timing, match review, escalation and records.
- Technology law guide
Acts as a technology-law information guide for software teams on privacy, licences, product terms and contracts, drafting for counsel review and separating general information from legal advice.
- Write an anti-money laundering risk assessment
Drafts a business-wide money laundering and terrorist financing risk assessment for a small regulated firm, rating customer, service, channel and geography risks and linking each to controls.
- Write a data retention schedule
Drafts a records and data retention schedule listing each record type, owner, system, retention trigger, period to verify, basis, and deletion or archiving method, with legal holds and review steps.
- Write a fire risk assessment
Writes a fire risk assessment for a small shop, office, café, salon or venue - hazards, people at risk, escape routes, alarms, equipment, training - with a dated action plan and on-site checks.
- Write a workplace risk assessment
Writes a workplace health and safety risk assessment covering hazards, who is at risk, existing controls, risk ratings, further actions with owners and a review date.
Not: secure coding (security).