> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Company: Acme Inc

Last updated: 2026-03-19

Project: nextjs-saas-example

This document provides a 12-month calendar view of all compliance activities for nextjs-saas-example, auto-populated based on 8 detected service(s) and applicable regulations.

> Disclaimer: This is not legal advice. Consult qualified legal counsel to confirm applicable obligations and deadlines for your specific situation.

## 1. Applicable Regulations

Based on your project configuration and detected services, the following regulations inform this calendar:

- CCPA/CPRA — California Consumer Privacy Act / California Privacy Rights Act
- EU AI Act — Regulation (EU) 2024/1689
- PCI DSS — Payment Card Industry Data Security Standard v4.0.1
- ePrivacy Directive — Cookie consent and electronic communications
- CAN-SPAM Act — US commercial email requirements

## 2. Monthly Calendar

### January

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Re-run Codepliant to detect new services or dependencies
- Review and update data processing agreements
- PCI DSS quarterly vulnerability scan (ASV)
- Review analytics data sharing and cookie consent configuration
- Conduct internal compliance audit (H1)
- AI system risk re-assessment (H1)
- Review regulatory landscape for new obligations
- Review "Do Not Sell or Share" mechanisms

Update:

- Full privacy policy review and update
- Review and update all compliance documents
- Update CCPA disclosures and data collection categories
- PCI DSS annual Self-Assessment Questionnaire

Report:

- Quarterly compliance status report
- Annual compliance summary report

### February

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Review employee privacy notice

Update:

- Staff data protection training refresh

### March

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Annual vendor and sub-processor review
- Review data backup and disaster recovery procedures

Update:

- Update sub-processor list

### April

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Re-run Codepliant to detect new services or dependencies
- Review and update data processing agreements
- PCI DSS quarterly vulnerability scan (ASV)
- Review analytics data sharing and cookie consent configuration

Report:

- Quarterly compliance status report
- Q1 compliance metrics report

### May

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Review and enforce data retention schedules
- Verify encryption at rest for all personal data stores

Update:

- Purge data past retention period

### June

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Review access controls and authentication policies
- Audit authentication session lengths and token lifetimes

Update:

- Rotate API keys and service credentials

### July

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Re-run Codepliant to detect new services or dependencies
- Review and update data processing agreements
- PCI DSS quarterly vulnerability scan (ASV)
- Review analytics data sharing and cookie consent configuration
- Conduct internal compliance audit (H2)
- AI system risk re-assessment (H2)

Update:

- Update risk register

Report:

- Quarterly compliance status report
- Mid-year compliance status report

### August

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Review AI Disclosure document for EU AI Act compliance
- Verify AI-generated content marking is operational

Update:

- Update AI Model Card and transparency documentation

### September

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Conduct data breach response drill
- Review email marketing consent records (CAN-SPAM / GDPR)

Update:

- Update incident response plan and communication templates

### October

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Re-run Codepliant to detect new services or dependencies
- Review and update data processing agreements
- PCI DSS quarterly vulnerability scan (ASV)
- Review analytics data sharing and cookie consent configuration

Report:

- Quarterly compliance status report
- Q3 compliance metrics report

### November

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Pre-audit preparation and gap analysis
- Review third-party risk assessments

Update:

- Update compliance roadmap for next year

### December

Review:

- Review data breach and incident logs
- Verify consent mechanisms are operational
- Review error monitoring and alerting thresholds
- Verify all annual compliance tasks are complete

Update:

- Archive compliance records for the year

Report:

- Annual compliance review report for board/leadership

## 3. Annual Summary

Month | Review | Update | Report
--- | --- | --- | ---
January | 11 items | 4 items | 2 items
February | 4 items | 1 items | 0 items
March | 5 items | 1 items | 0 items
April | 7 items | 0 items | 2 items
May | 5 items | 1 items | 0 items
June | 5 items | 1 items | 0 items
July | 9 items | 1 items | 2 items
August | 5 items | 1 items | 0 items
September | 5 items | 1 items | 0 items
October | 7 items | 0 items | 2 items
November | 5 items | 1 items | 0 items
December | 4 items | 1 items | 1 items
Total | 72 items | 13 items | 9 items

## 4. Service-Specific Compliance Activities

The following activities are included in the calendar based on detected services:

### AI Services (openai)

- Semi-annual AI risk re-assessment (Jan, Jul)
- Annual AI Disclosure and Model Card review (Aug)
- Ongoing AI-generated content marking verification

### Payment Services (stripe, stripe-ios)

- Annual PCI DSS Self-Assessment (Jan)
- Quarterly vulnerability scans (Jan, Apr, Jul, Oct)

### Analytics / Advertising (posthog)

- Quarterly cookie consent review (Jan, Apr, Jul, Oct)
- Annual CCPA "sale" classification review (Jan)

### Authentication Services (@supabase/supabase-js)

- Semi-annual access control audit (Jun)
- Token and session lifetime review (Jun)

### Email Services (resend)

- Annual consent record review (Sep)
- Unsubscribe mechanism verification (Sep)

### Storage / Database Services (prisma)

- Annual backup and DR review (Mar)
- Encryption verification (May)
- Data retention enforcement (May)

## 5. Tips for Using This Calendar

- Set reminders — Import key dates into your team calendar (Google Calendar, Outlook, etc.)
- Assign owners — Each activity should have a named responsible person
- Track completion — Use the checkboxes above to track progress throughout the year
- Re-generate — Run Codepliant after adding or removing services to keep this calendar current
- Adjust cadence — Some activities may need higher frequency depending on your risk profile

This compliance calendar was generated by Codepliant based on automated code analysis. It is for informational purposes only and does not constitute legal advice.