Compliance Review

Purpose

Assess proposed features and data flows against applicable privacy regulations, identify compliance gaps, and produce actionable remediation plans.

Inputs

• •Feature description or proposal being analyzed
• •Data elements collected, processed, or stored
• •User-facing consent flows and privacy notices
• •Third-party integrations and data sharing arrangements
• •Target jurisdictions and applicable regulations

Process

Step 1: Identify Applicable Regulations

Determine which regulatory frameworks apply based on user base, data types, and jurisdictions. Map each regulation to its key obligations:

• •GDPR (EU/EEA): Lawful basis, consent, right to access/erasure/portability, DPIAs, breach notification
• •CCPA/CPRA (California): Right to know, right to delete, right to opt-out, data sale restrictions
• •HIPAA (US health): PHI safeguards, minimum necessary standard, BAAs
• •SOC2: Security, availability, processing integrity, confidentiality, privacy trust principles
• •PCI-DSS: Cardholder data protection, network segmentation, access controls

Step 2: Map Data Flows for PII

Trace every data element through its lifecycle. For each element, document:

• •Collection point: Where and how is it gathered? (form, API, third-party sync)
• •Lawful basis: What legal ground justifies processing? (consent, contract, legitimate interest)
• •Storage location: Where does it live? (database, cache, logs, backups, third-party)
• •Processing purposes: What is it used for? (core feature, analytics, marketing, ML training)
• •Sharing: Who else receives it? (sub-processors, analytics vendors, ad networks)
• •Retention: How long is it kept? (active use, archival, legal hold)

Step 3: Assess Consent Mechanisms

Evaluate whether consent collection meets regulatory standards:

• •Is consent freely given, specific, informed, and unambiguous?
• •Are consent purposes granular (not bundled)?
• •Can users withdraw consent as easily as they gave it?
• •Is consent recorded with timestamp, version, and scope?
• •Are pre-checked boxes or dark patterns avoided?
• •Is there a mechanism for parental consent if minors are in scope?

Step 4: Evaluate Data Retention Policies

For each data category, assess:

• •Is there a defined retention period with documented justification?
• •Does the retention period align with the lawful basis? (consent-based data must be deletable)
• •Are automated deletion/anonymization processes in place?
• •Do backups respect retention limits, or do they create shadow copies?
• •Are legal hold requirements accounted for without overriding general deletion?

Step 5: Check Right-to-Deletion Compliance

Verify that data subject rights are technically implementable:

• •Can all PII for a given user be located across all systems?
• •Does deletion cascade to backups, caches, logs, and third-party systems?
• •Is soft-delete distinguished from hard-delete, and is hard-delete available?
• •Can deletion be completed within regulatory timeframes (e.g., 30 days for GDPR)?
• •Are there documented exceptions (legal obligations, legitimate interest overrides)?

Step 6: Design Audit Trail Requirements

Specify what must be logged for compliance evidence:

• •Consent events (granted, modified, withdrawn) with full context
• •Data access events (who accessed what PII, when, for what purpose)
• •Deletion/anonymization events (request received, processing, confirmation)
• •Breach-related events (detection, assessment, notification timeline)
• •Policy changes (consent text updates, retention policy modifications)

Output Format

Regulatory Applicability Matrix

Data Flow Map

[User] → [Collection Point] → [Processing Service] → [Data Store]
                                      ↓
                              [Third-Party / Sub-processor]

PII Elements: [list]
Lawful Basis: [basis per element]
Retention: [period per element]

Compliance Gap Analysis

Severity Key

• •Mandatory: Regulatory requirement — must fix before launch or risk enforcement action
• •Strongly Recommended: Best practice that significantly reduces risk — fix in current sprint
• •Advisory: Improvement that strengthens posture — schedule for next iteration

Quality Checks

• • All applicable regulations are identified with specific articles/sections referenced
• • Every PII element has a documented lawful basis for processing
• • Consent mechanisms meet the "freely given, specific, informed, unambiguous" standard
• • Data retention periods are defined and justified for every data category
• • Right-to-deletion path covers all storage locations including backups and caches
• • Third-party data sharing is documented with DPA/contractual coverage
• • Audit trail requirements cover consent, access, deletion, and breach events
• • Gap analysis includes specific, actionable remediation for every finding

Evolution Notes