1. Purpose
The Legal & Regulatory Compliance Checklist provides a structured method for reviewing whether the organization has identified, assessed, implemented, monitored, and evidenced applicable legal, regulatory, contractual, privacy, cybersecurity, and industry requirements.
The checklist is designed to help the organization demonstrate that compliance obligations are:
- Identified
- Verified
- Assessed for applicability
- Assigned to responsible owners
- Translated into operational requirements
- Mapped to relevant controls
- Implemented
- Supported by evidence
- Periodically reviewed
- Updated when requirements change
Core Principle
Identify → Verify → Assess → Map → Implement → Evidence → Review → Improve
2. When to Use
Use this checklist:
☐ During initial ISMS implementation
☐ During annual compliance review
☐ During internal audit
☐ Before entering a new jurisdiction
☐ Before launching a new product/service
☐ When entering a regulated industry
☐ When processing new information types
☐ When a law or regulation changes
☐ When customer requirements change
☐ When contracts introduce new obligations
☐ After a significant security/privacy incident
☐ During management review
☐ During certification or surveillance preparation
3. Organization Information
| Field | Details |
|---|---|
| Organization | |
| Assessment ID | |
| Assessment Date | |
| Assessment Period | |
| Reviewer | |
| Compliance Owner | |
| Security Owner | |
| Legal Reviewer | |
| Business Owner | |
| Jurisdictions Covered | |
| Assessment Status | |
| Next Review Date |
4. Legal and Regulatory Governance
Verify that the organization has established ownership for legal and regulatory compliance.
☐ Compliance responsibilities defined
☐ Legal responsibilities defined
☐ Information-security responsibilities defined
☐ Privacy responsibilities defined
☐ Business owners identified
☐ Risk owners identified
☐ Regulatory escalation process defined
☐ Management oversight established
☐ Compliance review frequency defined
☐ Appropriate independence maintained where required
Evidence
5. Applicable Jurisdictions
Identify all jurisdictions relevant to the organization.
☐ Country of incorporation
☐ Countries of operation
☐ Employee locations
☐ Customer locations
☐ Data-processing locations
☐ Cloud/data-center locations
☐ Supplier locations
☐ Subprocessor locations
☐ Countries receiving transferred data
☐ Countries where regulated services are provided
Jurisdiction Register
| Jurisdiction | Reason Applicable | Requirement Area | Owner | Review Status |
|---|---|---|---|---|
6. Legal and Regulatory Sources
Verify that appropriate sources have been identified.
☐ Government authorities
☐ Regulators
☐ Data-protection authorities
☐ Cybersecurity authorities
☐ Industry regulators
☐ Government notifications
☐ Regulatory circulars
☐ Official guidance
☐ Legal counsel
☐ External compliance advisers
☐ Industry associations
☐ Certification bodies
☐ Standards organizations
Source Verification
☐ Official source identified
☐ Source authenticity verified
☐ Current version confirmed
☐ Publication date recorded
☐ Effective date recorded
☐ Relevant amendments reviewed
7. Legal & Regulatory Requirements Register
Verify that the organization maintains a central register.
☐ Requirement ID assigned
☐ Requirement name recorded
☐ Source recorded
☐ Authority recorded
☐ Jurisdiction recorded
☐ Publication date recorded
☐ Effective date recorded
☐ Applicability recorded
☐ Requirement owner assigned
☐ Control owner assigned
☐ Compliance status recorded
☐ Evidence identified
☐ Review date recorded
Sample Register
| Requirement | Source | Jurisdiction | Applicable | Owner | Status | Evidence | Review Date |
|---|---|---|---|---|---|---|---|
8. Applicability Assessment
For each significant requirement:
☐ Legal entity assessed
☐ Jurisdiction assessed
☐ Industry assessed
☐ Business model assessed
☐ Products/services assessed
☐ Customer type assessed
☐ Information processed assessed
☐ Personal data assessed
☐ Technology assessed
☐ Cloud services assessed
☐ AI usage assessed
☐ Contractual obligations assessed
Applicability Result
☐ Applicable
☐ Applicable With Conditions
☐ Potentially Applicable
☐ Not Applicable
Rationale
A non-applicability decision should be documented where it may reasonably be questioned.
9. Compliance Obligation Assessment
Verify that applicable requirements have been converted into practical obligations.
☐ Requirement understood
☐ Individual obligations identified
☐ Mandatory requirements distinguished from guidance
☐ Deadlines identified
☐ Reporting obligations identified
☐ Notification obligations identified
☐ Record-keeping requirements identified
☐ Security requirements identified
☐ Privacy requirements identified
☐ Business requirements identified
☐ Responsible owners assigned
10. Information Security Requirements
Assess applicable legal/regulatory requirements relating to:
☐ Information security governance
☐ Security risk assessment
☐ Access control
☐ Authentication
☐ MFA
☐ Privileged access
☐ Encryption
☐ Key management
☐ Network security
☐ Vulnerability management
☐ Security testing
☐ Logging
☐ Monitoring
☐ Incident management
☐ Security awareness
☐ Supplier security
☐ Business continuity
☐ Disaster recovery
☐ Backup
☐ Secure development
☐ Cloud security
Assessment Notes
11. Privacy and Data Protection
Where personal data is processed:
☐ Applicable privacy laws identified
☐ Data categories identified
☐ Data subjects identified
☐ Processing purposes documented
☐ Lawful basis assessed where applicable
☐ Privacy notices reviewed
☐ Data minimization assessed
☐ Data-subject rights addressed
☐ Data retention requirements identified
☐ Data deletion requirements identified
☐ Data-processing agreements reviewed
☐ Processor requirements assessed
☐ Subprocessors assessed
☐ International transfers assessed
☐ Data security requirements assessed
☐ Breach notification requirements assessed
Privacy Evidence
12. Cybersecurity Requirements
Assess whether applicable cybersecurity obligations are addressed.
☐ Cybersecurity governance
☐ Security policies
☐ Risk management
☐ Security monitoring
☐ Vulnerability management
☐ Penetration testing
☐ Security assessments
☐ Incident response
☐ Cyber incident reporting
☐ Security logging
☐ Backup and recovery
☐ Business continuity
☐ Third-party security
☐ Cloud security
☐ Security awareness
13. Data Retention and Deletion
Verify requirements for information retention.
☐ Legal retention requirements identified
☐ Regulatory retention requirements identified
☐ Contractual retention requirements identified
☐ Customer requirements identified
☐ Privacy requirements considered
☐ Retention periods defined
☐ Data owners assigned
☐ Deletion process defined
☐ Secure deletion implemented
☐ Legal holds considered
☐ Backup retention considered
☐ Evidence of deletion maintained where appropriate
14. Data Location and Transfer
Assess requirements relating to where information is stored and transferred.
☐ Data locations identified
☐ Processing locations identified
☐ Backup locations identified
☐ Cloud locations identified
☐ Supplier locations identified
☐ Subprocessor locations identified
☐ Cross-border transfers identified
☐ Transfer requirements assessed
☐ Contractual restrictions assessed
☐ Customer requirements assessed
☐ Security requirements assessed
Data Location Register
| Data | Location | Processing | Transfer | Requirement | Status |
|---|---|---|---|---|---|
15. Incident and Breach Requirements
Verify applicable legal/regulatory incident obligations.
☐ Incident definitions reviewed
☐ Reporting thresholds identified
☐ Notification obligations identified
☐ Notification recipients identified
☐ Notification deadlines identified
☐ Customer notification requirements identified
☐ Regulatory notification requirements identified
☐ Data breach requirements identified
☐ Evidence preservation requirements considered
☐ Incident records maintained
☐ Legal/privacy escalation defined
☐ Regulatory communication process defined
Important
Actual regulatory notification requirements and deadlines should be determined from the applicable requirement rather than assumed from a generic incident-response process.
16. Business Continuity and Resilience
Assess applicable requirements relating to:
☐ Business continuity
☐ Disaster recovery
☐ Availability
☐ Recovery objectives
☐ Backup
☐ Recovery testing
☐ Critical supplier continuity
☐ Cloud resilience
☐ Emergency response
☐ Crisis management
☐ Communication
Evidence
17. Industry-Specific Requirements
Determine whether the organization operates in a regulated industry.
☐ Banking
☐ Financial services
☐ Insurance
☐ Payments
☐ Capital markets
☐ Healthcare
☐ Telecommunications
☐ Government
☐ Critical infrastructure
☐ Technology
☐ Other: ______________________
Applicable Industry Requirements
| Requirement | Authority | Applicable | Owner | Status |
|---|---|---|---|---|
18. Contractual and Customer Requirements
Verify that legal and regulatory requirements entering through contracts are addressed.
☐ Customer contracts reviewed
☐ MSA reviewed
☐ SOW reviewed
☐ DPA reviewed
☐ NDA reviewed
☐ Security addendum reviewed
☐ SLA reviewed
☐ Customer security requirements identified
☐ Security certification commitments identified
☐ Incident commitments identified
☐ Data-location commitments identified
☐ Data-deletion commitments identified
☐ Audit rights identified
☐ Subprocessor requirements identified
Contractual commitments should also be maintained in the Contractual Security Requirements Register.
19. Supplier and Third-Party Requirements
Assess legal/regulatory obligations involving suppliers.
☐ Supplier obligations identified
☐ Supplier contracts reviewed
☐ Security requirements included
☐ Privacy requirements included
☐ Data-processing requirements included
☐ Subprocessor requirements included
☐ Incident notification requirements included
☐ Data location assessed
☐ Supplier compliance evidence reviewed
☐ Critical supplier requirements monitored
20. AI and Generative AI Requirements
Where AI is used:
☐ AI-related laws/regulations identified
☐ AI governance requirements assessed
☐ AI system inventory maintained
☐ AI data-processing requirements assessed
☐ Personal data use assessed
☐ Customer data use assessed
☐ Model/provider requirements assessed
☐ AI transparency requirements assessed where applicable
☐ Human oversight requirements assessed where applicable
☐ AI security requirements assessed
☐ AI supplier/subprocessor requirements assessed
☐ AI contractual requirements assessed
21. Compliance-to-Control Mapping
Verify that obligations are connected to controls.
| Requirement | Obligation | Risk | Control | Owner | Evidence | Status |
|---|---|---|---|---|---|---|
Check:
☐ Each significant obligation has an identified control
☐ Control owner assigned
☐ Control implementation confirmed
☐ Evidence identified
☐ Control effectiveness considered
☐ Gaps recorded
22. ISO/IEC 27001 Mapping
Where relevant:
☐ Requirement mapped to ISMS process
☐ Relevant control identified
☐ Annex A mapping considered
☐ Non-Annex-A controls considered where necessary
☐ SoA reviewed where relevant
☐ Risk treatment reviewed
☐ Control owner assigned
☐ Evidence identified
Important
ISO/IEC 27001 Annex A should not be treated as a complete legal compliance checklist. Applicable controls should be determined through the organization’s information-security risk assessment and other relevant requirements.
23. Policy Review
Verify that applicable requirements are reflected in organizational policies.
☐ Information Security Policy
☐ Privacy Policy
☐ Access Control Policy
☐ Data Classification Policy
☐ Data Retention Policy
☐ Incident Management Policy
☐ Supplier Security Policy
☐ Cloud Security Policy
☐ Business Continuity Policy
☐ AI Security Policy
☐ Acceptable Use Policy
☐ Other: ______________________
Policy Gaps
24. Procedure Review
Verify that operational procedures support applicable requirements.
☐ Access management
☐ Access review
☐ Incident response
☐ Data breach response
☐ Regulatory notification
☐ Vulnerability management
☐ Security testing
☐ Supplier management
☐ Data retention/deletion
☐ Backup and recovery
☐ Disaster recovery
☐ Business continuity
☐ Evidence management
☐ Regulatory monitoring
25. Technical Control Review
Where applicable:
☐ IAM configured
☐ MFA enabled
☐ Least privilege implemented
☐ Encryption configured
☐ Logging enabled
☐ Monitoring enabled
☐ Backup configured
☐ Vulnerability scanning implemented
☐ Security testing performed
☐ Secure configuration implemented
☐ Data deletion controls implemented
☐ Cloud controls reviewed
☐ Security alerts monitored
26. Compliance Evidence Review
Verify that evidence is available.
☐ Policies
☐ Procedures
☐ Risk assessments
☐ Control assessments
☐ System configurations
☐ Access reviews
☐ Security testing
☐ Vulnerability assessments
☐ Audit reports
☐ Training records
☐ Incident records
☐ Backup evidence
☐ DR test reports
☐ Supplier assessments
☐ Contracts
☐ DPAs
☐ Regulatory assessments
☐ Management review records
27. Evidence Quality
For significant evidence, verify:
☐ Relevant
☐ Current
☐ Complete
☐ Accurate
☐ Authentic
☐ Traceable
☐ Appropriately protected
☐ Retained for required period
☐ Accessible to authorized reviewers
Evidence Gaps
28. Compliance Status
Classify each requirement.
☐ Compliant
☐ Partially Compliant
☐ Non-Compliant
☐ Not Assessed
☐ Not Applicable
☐ Further Review Required
Overall Assessment
29. Compliance Gap Register
Record identified gaps.
| Gap ID | Requirement | Gap | Risk | Action | Owner | Due Date | Status |
|---|---|---|---|---|---|---|---|
| GAP-001 |
30. Risk Treatment
For significant compliance gaps:
☐ Reduce risk
☐ Avoid activity
☐ Transfer/share risk where appropriate
☐ Accept risk through authorized process
☐ Implement compensating control
Risk Treatment
| Risk | Treatment | Control/Action | Owner | Due Date | Residual Risk |
|---|---|---|---|---|---|
31. Compliance Exceptions
Where an obligation cannot currently be fully met:
☐ Exception documented
☐ Reason documented
☐ Risk assessed
☐ Compensating control identified
☐ Legal review obtained where required
☐ Business owner approval obtained
☐ Risk owner approval obtained
☐ Expiry/review date established
☐ Corrective action created
Exception Details
Exceptions should be time-bound and periodically reviewed.
32. Regulatory Change Monitoring
Verify that regulatory changes are actively monitored.
☐ Regulatory sources identified
☐ Monitoring responsibilities assigned
☐ Monitoring frequency defined
☐ Regulatory changes recorded
☐ Effective dates tracked
☐ Applicability reassessed
☐ Impact assessed
☐ Controls updated
☐ Policies updated
☐ Evidence collected
☐ Management informed where necessary
33. Compliance Training and Awareness
Where applicable:
☐ Compliance responsibilities communicated
☐ Security training completed
☐ Privacy training completed
☐ Regulatory-specific training completed
☐ Role-specific training completed
☐ Training records maintained
☐ Training updated following significant changes
34. Management Review
Management should review significant compliance matters.
☐ New regulatory requirements
☐ Significant compliance gaps
☐ Overdue remediation
☐ Regulatory risks
☐ Customer commitments
☐ Security incidents
☐ Privacy incidents
☐ Regulatory notifications
☐ Exceptions
☐ Compliance trends
☐ Resource requirements
☐ Changes in business/jurisdiction
Management Decision
35. Internal Audit Review
Where included within the audit scope:
☐ Legal/regulatory register reviewed
☐ Applicability assessments reviewed
☐ Compliance obligations sampled
☐ Control implementation verified
☐ Evidence reviewed
☐ Gaps assessed
☐ Corrective actions reviewed
☐ Exceptions reviewed
☐ Regulatory monitoring reviewed
☐ Previous audit findings reviewed
Internal Audit Findings
36. Compliance Review Summary
| Area | Status | Key Finding | Risk | Action |
|---|---|---|---|---|
| Legal Requirements | ||||
| Regulatory Requirements | ||||
| Privacy | ||||
| Cybersecurity | ||||
| Contracts | ||||
| Customer Requirements | ||||
| Suppliers | ||||
| Data Retention | ||||
| Data Transfers | ||||
| Business Continuity | ||||
| AI | ||||
| Evidence | ||||
| Overall Compliance |
37. Compliance Review Decision
Assessment Result
☐ Compliant
☐ Compliant With Conditions
☐ Partially Compliant
☐ Remediation Required
☐ Risk Acceptance Required
☐ Further Assessment Required
☐ Not Applicable
Decision Rationale
38. Approval
Compliance Owner: __________________________
Security Owner: _____________________________
Business Owner: _____________________________
Legal Reviewer: ______________________________
Risk Owner: _________________________________
Approver: ___________________________________
Assessment Date: ____________________________
Next Review Date: ___________________________
39. AWS SaaS Startup Example
Consider a SaaS startup operating on AWS and serving customers across multiple jurisdictions.
The organization performs a legal and regulatory review covering:
- Privacy
- Cybersecurity
- Customer data
- Cloud services
- Incident management
- Data retention
- Cross-border data transfers
- AI usage
- Customer contracts
Assessment Flow
1. Identify
Relevant legal and regulatory requirements are recorded.
2. Verify
Official sources and effective dates are confirmed.
3. Assess Applicability
The organization evaluates:
- Where it operates
- Where customers are located
- What information is processed
- What services are provided
4. Assess Impact
The assessment identifies impacts on:
- AWS production
- Customer databases
- IAM
- Logging
- Incident response
- Data retention
- Supplier management
5. Map Controls
Example:
| Requirement Area | Control | Evidence |
|---|---|---|
| Access security | IAM + MFA + least privilege | Access review |
| Data protection | Encryption | AWS configuration |
| Monitoring | Cloud/security logging | Logs |
| Incident response | Incident procedure | Incident records |
| Recovery | Backup + DR | DR test |
| Supplier risk | Supplier assessment | Supplier review |
| Data retention | Retention controls | Retention records |
6. Identify Gaps
Example:
Customer data deletion process does not provide sufficient evidence that data has been deleted across all relevant systems.
7. Correct
Create corrective action:
Identify systems → define deletion process → implement → test → collect evidence → review effectiveness.
8. Validate
Compliance status is updated only after implementation and evidence have been reviewed.
40. Startup-Friendly Legal & Regulatory Review
A startup can begin with these ten questions:
- Where do we operate?
- Where are our customers?
- What information do we process?
- Which laws and regulations may apply?
- Which customer/contractual requirements apply?
- What exactly are we required to do?
- Which controls address those requirements?
- What evidence demonstrates compliance?
- Where are the gaps and risks?
- Who owns the requirement and when will it be reviewed again?
This provides a practical foundation without creating unnecessary compliance bureaucracy.
41. Common Mistakes
Avoid:
- Treating compliance as a list of laws.
- Assuming every law applies to the organization.
- Using outdated regulatory information.
- Relying only on third-party summaries.
- Failing to verify effective dates.
- Confusing guidance with mandatory obligations.
- Treating ISO 27001 certification as proof of legal compliance.
- Treating a policy as evidence that a control operates effectively.
- Ignoring customer contractual commitments.
- Ignoring supplier obligations.
- Ignoring cross-border data requirements.
- Ignoring AI-related requirements where AI is used.
- Failing to document non-applicability decisions.
- Closing compliance gaps without evidence.
- Allowing exceptions to remain open indefinitely.
- Failing to reassess requirements after business changes.
42. Relationship With Other ISMS Documents
| Document | Relationship |
|---|---|
| Legal & Regulatory Requirements Register | Central list of applicable requirements |
| Regulatory Monitoring Procedure | Defines regulatory monitoring |
| Regulatory Monitoring Register | Tracks regulatory changes |
| Compliance Obligations Assessment | Assesses individual obligations |
| Contractual Security Requirements Register | Tracks contractual commitments |
| Requirement-to-Control Mapping Matrix | Connects requirements to controls |
| Risk Register | Tracks compliance-related risks |
| Statement of Applicability | Records applicable ISMS controls |
| Corrective Action Tracker | Tracks remediation |
| Internal Audit | Tests implementation and evidence |
| Management Review | Provides management oversight |
| ISMS Improvement Log | Tracks improvements |
43. ISO/IEC 27001 Alignment
This checklist supports the organization’s risk-based information-security management system by providing evidence that relevant legal, regulatory, contractual, and other requirements have been identified and considered.
It can support:
- Organizational context
- Interested-party requirements
- Information-security risk assessment
- Risk treatment
- Control selection
- Statement of Applicability
- Operational control implementation
- Compliance monitoring
- Internal audit
- Management review
- Continual improvement
This checklist is an organizational template, not a mandatory ISO/IEC 27001 form.
The organization should determine the specific legal and regulatory requirements applicable to its own:
- Jurisdictions
- Business model
- Industry
- Customers
- Information
- Technology
- Contracts
- Risk environment
44. Audit Evidence
The organization should retain appropriate evidence such as:
- Legal and regulatory requirements register
- Regulatory monitoring records
- Applicability assessments
- Compliance obligations assessments
- Requirement-to-control mappings
- Risk assessments
- Policies
- Procedures
- Technical evidence
- Security testing
- Privacy assessments
- Contracts
- DPAs
- Supplier assessments
- Incident records
- Training records
- Corrective actions
- Exceptions and risk acceptance
- Management review records
- Internal audit records
The evidence should allow the organization to demonstrate:
Requirement → Applicability → Obligation → Risk → Control → Implementation → Evidence → Assessment → Action → Approval → Review
45. Final Audit Trail
For every significant legal or regulatory requirement:
Requirement Identified
↓
Source Verified
↓
Jurisdiction Confirmed
↓
Applicability Assessed
↓
Obligation Understood
↓
Business/Information/Technology Impact Assessed
↓
Risk Assessed
↓
Control Identified
↓
Policy/Procedure Mapped
↓
Evidence Identified
↓
Compliance Assessed
↓
Gap Identified
↓
Corrective Action Assigned
↓
Control Implemented
↓
Evidence Validated
↓
Residual Risk Assessed
↓
Approval Recorded
↓
Requirement Monitored
↓
Periodic Review
46. Final Principle
Legal and regulatory compliance is not simply maintaining a list of laws.
An effective compliance program connects the applicable requirement to the organization’s actual business activities, information, technology, risks, controls, owners, evidence, and decisions.
Final Principle
Identify → Verify → Assess Applicability → Understand Obligations → Assess Risk → Map Controls → Implement → Evidence → Validate → Remediate → Approve → Monitor → Improve