# Annual Compliance Review Checklist

> **Acme Inc** — Annual Compliance Review
>
> Generated on 2026-03-19 by [Codepliant](https://github.com/joechensmartz/codepliant)
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## 1. Review Metadata

| Field | Details |
|-------|---------|
| **Organization** | Acme Inc |
| **Review Lead** | Jane Mueller |
| **Contact** | dpo@acme-saas.com |
| **Review Period** | [Start Date] to [End Date] |
| **Checklist Generated** | 2026-03-19 |
| **Review Deadline** | [Set deadline — typically within 30 days of start] |

## 2. Document Review Checklist

Review each compliance document for accuracy and completeness. Update any document that no longer reflects current practices.

| # | Document | Filename | Review Frequency | Status |
|---|----------|----------|-----------------|--------|
| 1 | Privacy Policy | `PRIVACY_POLICY.md` | Annual + on change | - [ ] Reviewed |
| 2 | Terms of Service | `TERMS_OF_SERVICE.md` | Annual + on change | - [ ] Reviewed |
| 3 | Security Policy | `SECURITY.md` | Annual + after incidents | - [ ] Reviewed |
| 4 | Record of Processing Activities | `RECORD_OF_PROCESSING_ACTIVITIES.md` | Annual + on change | - [ ] Reviewed |
| 5 | Sub-Processor List | `SUBPROCESSOR_LIST.md` | Quarterly recommended, Annual minimum | - [ ] Reviewed |
| 6 | Refund Policy | `REFUND_POLICY.md` | Annual | - [ ] Reviewed |
| 7 | AI Disclosure | `AI_DISCLOSURE.md` | Annual + on AI service changes | - [ ] Reviewed |
| 8 | AI Governance Framework | `AI_GOVERNANCE_FRAMEWORK.md` | Annual + on model changes | - [ ] Reviewed |
| 9 | Cookie Policy | `COOKIE_POLICY.md` | Annual + on analytics changes | - [ ] Reviewed |

### Detailed Review Items per Document

#### Privacy Policy (`PRIVACY_POLICY.md`)

- [ ] All third-party services listed match current integrations
- [ ] Data collection descriptions are accurate
- [ ] Legal basis assignments are correct
- [ ] Contact information is current
- [ ] Data retention periods reflect actual practices

#### Terms of Service (`TERMS_OF_SERVICE.md`)

- [ ] Service description matches current offering
- [ ] Limitation of liability clauses are appropriate
- [ ] Governing law and jurisdiction are correct
- [ ] Acceptable use provisions are current

#### Security Policy (`SECURITY.md`)

- [ ] Security measures reflect current infrastructure
- [ ] Responsible disclosure process is functional
- [ ] Contact information is current
- [ ] Vulnerability response timelines are achievable

#### Record of Processing Activities (`RECORD_OF_PROCESSING_ACTIVITIES.md`)

- [ ] All processing activities are documented
- [ ] New services/integrations are reflected
- [ ] Lawful basis for each activity is reviewed
- [ ] Data transfer mechanisms are current
- [ ] Retention periods match actual practices

#### Sub-Processor List (`SUBPROCESSOR_LIST.md`)

- [ ] All sub-processors are listed
- [ ] DPA status is verified for each sub-processor
- [ ] New vendors have been assessed
- [ ] Discontinued vendors have been removed
- [ ] Data processing locations are accurate

#### Refund Policy (`REFUND_POLICY.md`)

- [ ] Refund terms match current business practices
- [ ] Payment processor information is current
- [ ] Consumer protection requirements are met

#### AI Disclosure (`AI_DISCLOSURE.md`)

- [ ] AI services listed match current integrations
- [ ] Data handling descriptions are accurate
- [ ] Risk classification is current
- [ ] Transparency obligations under EU AI Act are met

#### AI Governance Framework (`AI_GOVERNANCE_FRAMEWORK.md`)

- [ ] AI risk assessments are up to date
- [ ] Human oversight mechanisms are functioning
- [ ] AI model cards are current
- [ ] Bias monitoring is in place

#### Cookie Policy (`COOKIE_POLICY.md`)

- [ ] Cookie inventory is complete and accurate
- [ ] Third-party cookies are documented
- [ ] Consent mechanism is functioning properly
- [ ] Cookie lifetimes match actual settings

## 3. Regulatory Calendar

Key compliance dates and deadlines for the review period:

| Month | Activity | Regulation | Owner |
|-------|----------|-----------|-------|
| January | Annual compliance review kickoff | All | DPO |
| January | Review and update ROPA | GDPR Art. 30 | DPO |
| March | PCI DSS self-assessment questionnaire | PCI DSS | Security Lead |
| April | Data breach drill / tabletop exercise | GDPR Art. 33-34 | Incident Response Team |
| June | Mid-year sub-processor audit | GDPR Art. 28 | DPO |
| July | Employee privacy training refresh | GDPR Art. 39 | HR / DPO |
| August | Cookie consent mechanism audit | ePrivacy Directive | Marketing / DPO |
| September | Third-party vendor risk reassessment | GDPR Art. 28 | Procurement / DPO |
| October | DSAR process review and testing | GDPR Art. 15-22 | DPO |
| October | AI system audit and bias review | EU AI Act | AI Governance Lead |
| November | Security policy and access control review | ISO 27001 / SOC 2 | Security Lead |
| December | Year-end compliance summary and planning | All | DPO |

## 4. Operational Compliance Checks

### Data Subject Rights

- [ ] DSAR process tested end-to-end within the past 12 months
- [ ] Average DSAR response time is within 30-day requirement
- [ ] All DSAR requests from the past year have been documented
- [ ] Right to erasure process verified (data actually deleted)
- [ ] Data portability export format tested

### Data Breach Preparedness

- [ ] Incident response plan reviewed and updated
- [ ] Breach notification templates are current
- [ ] 72-hour notification capability tested
- [ ] Breach register is maintained
- [ ] All team members know the breach reporting process

### Technical Measures

- [ ] Encryption in transit (TLS/SSL) verified
- [ ] Encryption at rest verified for all personal data stores
- [ ] Access control lists reviewed — principle of least privilege
- [ ] Multi-factor authentication enabled for admin access
- [ ] Backup and recovery procedures tested
- [ ] Penetration test conducted within the past 12 months
- [ ] Dependency vulnerability scan run and critical issues resolved

### Training and Awareness

- [ ] All staff completed data protection awareness training
- [ ] Engineering team trained on privacy by design principles
- [ ] Customer support trained on DSAR handling
- [ ] Incident response team trained on breach procedures

## 5. Third-Party Service Assessment

Review each third-party service for continued compliance:

| Service | Category | DPA in Place | Last Reviewed | Action Needed |
|---------|----------|-------------|---------------|---------------|
| @sentry/node | monitoring | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| @supabase/supabase-js | auth | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| openai | ai | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| posthog | analytics | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| prisma | database | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| resend | email | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| stripe | payment | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |
| stripe-ios | payment | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove] |

## 6. Review Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Data Protection Officer | | | |
| Chief Information Security Officer | | | |
| Legal Counsel | | | |
| Chief Technology Officer | | | |

## Review Notes

### What a lawyer should check

- Ensure the regulatory calendar covers all applicable jurisdictions
- Verify DSAR response timelines meet local law requirements
- Confirm breach notification procedures align with all applicable regulations
- Review third-party DPA status for completeness

### Auto-generated vs. needs human input

| Section | Status | Confidence |
|---------|--------|------------|
| Document review list | Auto-generated from detected documents | High |
| Regulatory calendar | Template with common dates | Medium — customize for jurisdiction |
| Operational checks | Standard checklist | High |
| Third-party assessment | Auto-populated from scan | High — services accurate |
| Sign-off section | Template — needs completion | N/A |

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Record of Processing Activities (`RECORD_OF_PROCESSING_ACTIVITIES.md`)
- Compliance Timeline (`COMPLIANCE_TIMELINE.md`)
- Compliance Notes (`COMPLIANCE_NOTES.md`)
- Sub-Processor List (`SUBPROCESSOR_LIST.md`)
- Incident Response Plan (`INCIDENT_RESPONSE_PLAN.md`)
- DSAR Handling Guide (`DSAR_HANDLING_GUIDE.md`)

---

*This Annual Review Checklist was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on code analysis. It should be customized to reflect your organization's specific compliance obligations and reviewed by legal counsel.*
