02 — Legal Issues Checklist#

Identify legal, licensing, contractual, privacy, and regulatory questions early. This is an issue-spotting tool, not legal advice or a certification of compliance.

Scope: Backend / API-specific. This file is one part of the 02_LegalIssues.md checklist. Apply the domain-wide release gate across all applicable scope files; each checklist ID remains unique.

Review details#

• Project / product:
• Release / version / environment:
• Scope and applicable jurisdictions / markets:
• Reviewer / owner:
• Review date:
• Decision: Pending / Approved / Approved with documented exceptions / Blocked

How to use#

1. Copy this template into each project's review records; keep the shared repository template unchecked.
2. Check [x] only after verifying the item with evidence. For any inapplicable item, record N/A and the reason in the project's own review notes or issue tracker using its checklist ID; do not mark it as passed.
3. Record evidence links or artifact references by checklist ID. Open an issue for every failed item, assign an owner and due date, and retest after remediation.
4. Apply the release gate below. These checklists guide review; they do not replace qualified specialist review when required.

Intellectual property and licensing#

• LEG-010 Copyright/takedown, infringement complaints, and rights-request handling have an assigned process.

Approvals and ongoing governance#

• LEG-050 Verify withdrawal, complaint, breach, and regulator-request workflows are tested and operational.

API Checks#

Apply to API endpoints, client integrations, webhooks, or data feeds present in the project. Record N/A with reasons if none exist.

Reference basis: EU General Data Protection Regulation (Regulation 2016/679); UK ICO — What privacy information should we provide?; UK ICO — Cookies and similar technologies (guidance under review).

• LEG-051 Inventory external, partner, internal, and third-party APIs and document personal data or regulated information transmitted by each.
• LEG-052 Check API-provider terms, usage restrictions, data ownership, sublicensing, retention, and commercial redistribution rights.
• LEG-053 Identify controller/processor or other applicable roles for data passed through API integrations; obtain required agreements.
• LEG-054 Assess cross-border API data flows and whether safeguards, hosting restrictions, or notices are legally required.
• LEG-055 Verify API retention, access, deletion, portability, and correction capabilities support applicable data-subject rights.
• LEG-056 Check that publicly documented APIs and developer portals publish accurate license, attribution, acceptable-use, and usage-limit terms.
• LEG-057 Confirm data returned to external API consumers is consistent with disclosed purposes and contractual restrictions.
• LEG-058 Validate whether API logging, IP-address handling, tokens, and telemetry are personal data under relevant law.
• LEG-059 Document notification, audit, breach reporting, and subprocessor obligations for API vendors and customers.
• LEG-060 Assess legal and contractual constraints on webhooks, exports, bulk retrieval, and onward sharing of data.
• LEG-061 For AI APIs, document training/retention controls, prohibited use cases, output rights, and service-specific disclosures.

Release gate#

• All applicable high-priority checks above pass, or an authorized decision-maker has explicitly accepted and documented each residual risk.
• Failed items have tracked remediation, owners, and deadlines; material blockers remain blocked until resolved.
• Evidence links and the reviewer, review date, and final decision are recorded.

Domain-specific approval rule: Block release for missing mandatory licenses, unlawful personal-data practices, unlicensed critical assets, or unresolved material regulatory obligations. Require qualified legal sign-off when appropriate.

Trusted references and scope#

The checks above are adapted into practical verification questions from these authoritative publications (not copied as standards text). Verify current versions and the project's scope before sign-off.

• EU General Data Protection Regulation (Regulation 2016/679)
• UK ICO — What privacy information should we provide?
• UK ICO — Cookies and similar technologies (guidance under review)
• European Data Protection Board — ePrivacy technical scope guidelines
• W3C — WCAG 2.2 Overview
• NIST — Generative AI Risk Management Profile

These examples are issue-spotting checks. EU and UK sources do not automatically govern other markets; determine actual applicability and seek local legal counsel. Cookie and consumer-protection obligations can vary and guidance changes.

Source review date: 2026-11-12.

Suggested testing tools#

Choose tools appropriate to the project's stack and risks; automation supports evidence but does not approve the checklist.

• Test focus: consent, retention, access, export, deletion, and policy-enforcement behavior (legal interpretation remains manual); include API and service behavior where applicable.
• Cross-stack: Playwright + Open Policy Agent.
• Python: pytest; for pytest-based suites, run python -m pytest -q.
• TypeScript: Playwright + Vitest; for Vitest-based suites, run npx vitest run (or npx playwright test for E2E).
• JavaScript: Playwright + Jest; for Jest-based suites, run npx jest --ci (or npx playwright test for E2E).
• Evidence: Save tool versions, configuration, test environment, fixtures, results, and links in project-specific review records using the existing checklist IDs. Expert review remains necessary where relevant.

Suggested AI skills for verification#

These are optional agent review aids, not automated passes or release approval. Each linked repository had at least 1,000 GitHub stars when checked on 2026-11-12; counts are per repository, not per skill, and do not indicate security or correctness.

• gdpr-data-handling — Review GDPR-related data flows when applicable (wshobson/agents, 42,437 repo stars).
• audit-integrity — Inspect integrity of audit trails and approvals (github/awesome-copilot, 41,073 repo stars).
• spec-to-code-compliance — Compare documented privacy/security rules with implementation (trailofbits/skills, 8,150 repo stars).

How to check: In a project-specific copy, have the agent audit the backend / API scope and map findings to this file's existing checklist IDs, with code/configuration references, reproducible test results, failed or inapplicable cases, and uncertainties. Independently verify findings; keep shared template boxes unchecked and retain human approval requirements.

Before use: Read the skill's SKILL.md, referenced scripts, license, and requested tool permissions. Only execute vetted skills with appropriate access in a controlled environment.

Important warning: reference only#

⚠️ Reference only — not a definitive or exhaustive checklist. This template is a starting point for review, not the ultimate authority or a guarantee of project safety, quality, regulatory compliance, accessibility, security, or launch readiness.

Use project-specific judgment and independent verification. Requirements and risks evolve and differ by project, technology, and jurisdiction. Adapt the checks, consult current authoritative sources, perform relevant tests, and obtain qualified specialist review or approval when appropriate. Checking every box does not replace these steps.