// playbooks

Every work product
runs on a playbook.

Counsel-authored SOPs for the work we do most: executed on the platform, versioned, and always exam-ready. The judgment is a lawyer's; the procedure is what makes it repeatable and defensible. Every playbook below is live today.

sop/pia.md

Privacy Impact Assessment

Clear a new product, feature or data use before it ships. GDPR Art. 35 · CPRA.

Intake: scope the processing, data types and purpose

Auto-map the data flows and surface high-risk factors

Score necessity, proportionality and safeguards

Counsel reviews residual risk and records the rationale

Sign, version and schedule the re-review

sop/dpa.md

Data Processing Agreement

Review, counter and execute processor terms with flow-downs that hold.

Intake the paper and classify the processing roles

Redline against counsel-set fallback positions

Negotiate sub-processor and flow-down terms

Counsel signs off residual positions

Execute, version, calendar the renewal

sop/dsar.md

Data Subject Access Request

Intake to response on a clock, with identity checks and exemption logic.

Verified intake with identity confirmation

Locate and collate the subject’s data

Apply exemptions and third-party redactions

Counsel review of the response package

Respond in-deadline; log and close

sop/baa.md

HIPAA Business Associate Agreement

Review and redline BAAs; auto-detects whether the client is business associate or covered entity and applies the matching positions. 45 CFR 164.504(e).

Intake the BAA and detect the side: BA or CE

Term-by-term review against the firm playbook

Run the §164.504(e) required-provision checklist

Counsel signs the redline and residual positions

Execute, version, calendar the review

sop/triage.md

Use-Case Triage

Does this need a PIA, a mandatory DPIA, or can it proceed? Answered in a day, not a month, with the rationale recorded.

Intake the activity, data types and purpose

Screen against mandatory DPIA triggers

Check for privacy-policy conflicts

Route: PIA, DPIA, or proceed; rationale recorded

Log the decision; wire the re-review

sop/reg-gap.md

Regulatory Gap Analysis

A new reg drops: diff it against current policy and practice, output a gap list and a dated remediation plan.

Intake the regulation or amendment text

Diff against current policy and documented practice

Produce the gap list, ranked by exposure

Build the remediation plan: owners and dates

Counsel signs; feed the horizon.log

sop/policy.md

Policy Monitor

Keep the privacy policy current with practice: a weekly sweep of PIAs, DPA reviews and triage results to catch drift before a regulator does.

Sweep the week’s PIAs, reviews and triage results

Detect drift between policy and documented practice

Draft the policy update with rationale

Counsel approves the change

Publish and version the policy

sop/ir.md

Incident & Breach Response

Detection to multi-jurisdiction notice, privilege-first from the opening hour. GDPR Arts. 33–34 · HIPAA · US state breach statutes.

Open under privilege; start the record and the timeline

Scope it: systems, data types, individuals, jurisdictions

Test notifiability against every clock that applies

Counsel signs the notification decision and the drafts

Notify in-deadline; close with the post-incident review

sop/vra.md

Vendor / AI Risk Assessment

Score vendors and models before they touch your data, and again at every renewal.

Intake the vendor, the data it touches and the AI in its stack

Diligence security, sub-processors and training-data terms

Score the risk and set the conditions of use

Counsel signs the position; conditions land in the DPA

Version the assessment; calendar the renewal review

sop/ropa.md

Records of Processing

Article 30 records as a living register, maintained continuously rather than rebuilt every audit season. GDPR Art. 30.

Inventory the processing activities, systems and owners

Record purposes, lawful bases, categories and recipients

Map transfers, retention and the safeguards on each

Counsel reviews the entries and the gaps they expose

Publish the register; wire changes in from PIA and vendor reviews

trust / our-own-pia.mdwe are our own first client

publishedOur own AI-use PIA. Produced on the platform, in the platform's format, and published in the Trust Center; a privacy firm marketing AI tooling should be able to show its own paperwork.Trust Center

bring us the question →

Every work productruns on a playbook.