Skip to main content

Legal

Overview​

Legal is another domain of the organisation. The Manual does not say how Legal drafts; it says what must exist: security clauses in contracts, legal validation where the risk level requires it, and the DPO where there is personal data.

It is a frequent partner of GRC / Compliance, but it is a role of its own: drafting and validating clauses is a competence that GRC does not claim.

Key Responsibilities​

  • Integrate the security clauses into contracts with suppliers and contractors
  • Validate clauses on data handling, location and audit rights with AI model providers
  • Through the DPO, independently validate the privacy analysis at L3

Specialisation: Legal (DPO) — the data protection officer, who may be external.

Organisational Context​

The contract is where a supplier's obligation is born. Without clauses, the Manual has no way to ask those who deliver from outside for demonstrable alignment.

Regulatory Framework​

Supports:

  • GDPR: Contracts with processors (Art. 28) and independence of the DPO (Art. 38)
  • DORA: Contractual arrangements with ICT third parties
  • AI Act: Contractual responsibilities along the AI system value chain

Activities by Chapter​

Ch. 03 - Threat Modelling​

Through the DPO, independently review the LINDDUN analysis at L3.

Ch. 14 - Governance and Contracting​

Include SbD-ToE clauses in contracts and the minimum clauses of contracts with AI model providers.

User Stories:

Chapter References​

For full context and framing: