> Acme Inc — Annual Compliance Review

>

> Generated on 2026-03-19 by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Review Metadata

Field | Details
--- | ---
Organization | Acme Inc
Review Lead | Jane Mueller
Contact | dpo@acme-saas.com
Review Period | [Start Date] to [End Date]
Checklist Generated | 2026-03-19
Review Deadline | [Set deadline — typically within 30 days of start]

## 2. Document Review Checklist

Review each compliance document for accuracy and completeness. Update any document that no longer reflects current practices.

# | Document | Filename | Review Frequency | Status
--- | --- | --- | --- | ---
1 | Privacy Policy | `PRIVACY_POLICY.md` | Annual + on change | - [ ] Reviewed
2 | Terms of Service | `TERMSOFSERVICE.md` | Annual + on change | - [ ] Reviewed
3 | Security Policy | `SECURITY.md` | Annual + after incidents | - [ ] Reviewed
4 | Record of Processing Activities | `RECORDOFPROCESSING_ACTIVITIES.md` | Annual + on change | - [ ] Reviewed
5 | Sub-Processor List | `SUBPROCESSOR_LIST.md` | Quarterly recommended, Annual minimum | - [ ] Reviewed
6 | Refund Policy | `REFUND_POLICY.md` | Annual | - [ ] Reviewed
7 | AI Disclosure | `AI_DISCLOSURE.md` | Annual + on AI service changes | - [ ] Reviewed
8 | AI Governance Framework | `AIGOVERNANCEFRAMEWORK.md` | Annual + on model changes | - [ ] Reviewed
9 | Cookie Policy | `COOKIE_POLICY.md` | Annual + on analytics changes | - [ ] Reviewed

### Detailed Review Items per Document

#### Privacy Policy (`PRIVACY_POLICY.md`)

- All third-party services listed match current integrations
- Data collection descriptions are accurate
- Legal basis assignments are correct
- Contact information is current
- Data retention periods reflect actual practices

#### Terms of Service (`TERMSOFSERVICE.md`)

- Service description matches current offering
- Limitation of liability clauses are appropriate
- Governing law and jurisdiction are correct
- Acceptable use provisions are current

#### Security Policy (`SECURITY.md`)

- Security measures reflect current infrastructure
- Responsible disclosure process is functional
- Contact information is current
- Vulnerability response timelines are achievable

#### Record of Processing Activities (`RECORDOFPROCESSING_ACTIVITIES.md`)

- All processing activities are documented
- New services/integrations are reflected
- Lawful basis for each activity is reviewed
- Data transfer mechanisms are current
- Retention periods match actual practices

#### Sub-Processor List (`SUBPROCESSOR_LIST.md`)

- All sub-processors are listed
- DPA status is verified for each sub-processor
- New vendors have been assessed
- Discontinued vendors have been removed
- Data processing locations are accurate

#### Refund Policy (`REFUND_POLICY.md`)

- Refund terms match current business practices
- Payment processor information is current
- Consumer protection requirements are met

#### AI Disclosure (`AI_DISCLOSURE.md`)

- AI services listed match current integrations
- Data handling descriptions are accurate
- Risk classification is current
- Transparency obligations under EU AI Act are met

#### AI Governance Framework (`AIGOVERNANCEFRAMEWORK.md`)

- AI risk assessments are up to date
- Human oversight mechanisms are functioning
- AI model cards are current
- Bias monitoring is in place

#### Cookie Policy (`COOKIE_POLICY.md`)

- Cookie inventory is complete and accurate
- Third-party cookies are documented
- Consent mechanism is functioning properly
- Cookie lifetimes match actual settings

## 3. Regulatory Calendar

Key compliance dates and deadlines for the review period:

Month | Activity | Regulation | Owner
--- | --- | --- | ---
January | Annual compliance review kickoff | All | DPO
January | Review and update ROPA | GDPR Art. 30 | DPO
March | PCI DSS self-assessment questionnaire | PCI DSS | Security Lead
April | Data breach drill / tabletop exercise | GDPR Art. 33-34 | Incident Response Team
June | Mid-year sub-processor audit | GDPR Art. 28 | DPO
July | Employee privacy training refresh | GDPR Art. 39 | HR / DPO
August | Cookie consent mechanism audit | ePrivacy Directive | Marketing / DPO
September | Third-party vendor risk reassessment | GDPR Art. 28 | Procurement / DPO
October | DSAR process review and testing | GDPR Art. 15-22 | DPO
October | AI system audit and bias review | EU AI Act | AI Governance Lead
November | Security policy and access control review | ISO 27001 / SOC 2 | Security Lead
December | Year-end compliance summary and planning | All | DPO

## 4. Operational Compliance Checks

### Data Subject Rights

- DSAR process tested end-to-end within the past 12 months
- Average DSAR response time is within 30-day requirement
- All DSAR requests from the past year have been documented
- Right to erasure process verified (data actually deleted)
- Data portability export format tested

### Data Breach Preparedness

- Incident response plan reviewed and updated
- Breach notification templates are current
- 72-hour notification capability tested
- Breach register is maintained
- All team members know the breach reporting process

### Technical Measures

- Encryption in transit (TLS/SSL) verified
- Encryption at rest verified for all personal data stores
- Access control lists reviewed — principle of least privilege
- Multi-factor authentication enabled for admin access
- Backup and recovery procedures tested
- Penetration test conducted within the past 12 months
- Dependency vulnerability scan run and critical issues resolved

### Training and Awareness

- All staff completed data protection awareness training
- Engineering team trained on privacy by design principles
- Customer support trained on DSAR handling
- Incident response team trained on breach procedures

## 5. Third-Party Service Assessment

Review each third-party service for continued compliance:

Service | Category | DPA in Place | Last Reviewed | Action Needed
--- | --- | --- | --- | ---
@sentry/node | monitoring | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
@supabase/supabase-js | auth | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
openai | ai | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
posthog | analytics | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
prisma | database | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
resend | email | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
stripe | payment | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]
stripe-ios | payment | - [ ] Yes | [Date] | [None / Update DPA / Replace / Remove]

## 6. Review Sign-Off

Role | Name | Date | Signature
--- | --- | --- | ---
Data Protection Officer |  |  |
Chief Information Security Officer |  |  |
Legal Counsel |  |  |
Chief Technology Officer |  |  |

## Review Notes

### What a lawyer should check

- Ensure the regulatory calendar covers all applicable jurisdictions
- Verify DSAR response timelines meet local law requirements
- Confirm breach notification procedures align with all applicable regulations
- Review third-party DPA status for completeness

### Auto-generated vs. needs human input

Section | Status | Confidence
--- | --- | ---
Document review list | Auto-generated from detected documents | High
Regulatory calendar | Template with common dates | Medium — customize for jurisdiction
Operational checks | Standard checklist | High
Third-party assessment | Auto-populated from scan | High — services accurate
Sign-off section | Template — needs completion | N/A

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Record of Processing Activities (`RECORDOFPROCESSING_ACTIVITIES.md`)
- Compliance Timeline (`COMPLIANCE_TIMELINE.md`)
- Compliance Notes (`COMPLIANCE_NOTES.md`)
- Sub-Processor List (`SUBPROCESSOR_LIST.md`)
- Incident Response Plan (`INCIDENTRESPONSEPLAN.md`)
- DSAR Handling Guide (`DSARHANDLINGGUIDE.md`)

This Annual Review Checklist was auto-generated by Codepliant based on code analysis. It should be customized to reflect your organization's specific compliance obligations and reviewed by legal counsel.