regulatory-compliance-oimiragieo

Regulatory Compliance Skill

Overview

Assess systems, processes, and artifacts against major regulatory frameworks:

• GDPR/CCPA — Data privacy compliance for EU and California/US state laws
• Privacy-by-Design — Proactive privacy embedding following Ann Cavoukian's 7 principles
• ADA/WCAG — Web and software accessibility under ADA and WCAG 2.1/2.2 AA standards
• DPA Validation — Data Processing Agreement completeness and correctness checks
• Regulatory Monitoring — Guidance on tracking regulatory changes across jurisdictions

Output is structured as PASS / CONDITIONAL / FAIL with severity-rated findings and actionable remediation tasks.

When to Use

• Before deploying any feature that collects, processes, or stores personal data
• During architecture review for systems touching PII or user data
• When validating third-party vendor agreements and DPAs
• Before launching products in EU, California, or any jurisdiction with active privacy law
• When auditing accessibility compliance for public-facing interfaces
• As part of CI compliance gates for data pipelines and APIs

Iron Laws

1. NEVER report PASS on partial compliance — if any item fails, the result is CONDITIONAL or FAIL; partial compliance masks violations.
2. ALWAYS include remediation tasks with specific owning agents — vague findings don't produce fixes; every FAIL/CONDITIONAL must specify who fixes it and how.
3. NEVER skip multi-jurisdiction check — GDPR, CCPA, and 20+ US state laws may all apply; document scope clearly.
4. ALWAYS verify privacy-by-design at design time — retrofitting privacy after deployment is significantly more costly and less effective.
5. NEVER treat accessibility as optional — ADA/WCAG compliance carries active litigation risk (ADA lawsuits up 37% H1 2025); all public interfaces must be validated.
6. ALWAYS document regulation version and date assessed — regulatory guidance evolves; stamp every report with the regulation version and assessment date.