Tutorial 06: Legal Plugin Workflows

/review-contract

## CONTRACT ANALYSIS: Software License Agreement
**Contract Type**: SaaS Subscription Agreement
**Our Role**: Customer/Licensee
**Counterparty**: Acme Software Inc.

### CLAUSE ANALYSIS

#### 1. LICENSE GRANT (Section 2.1)
GREEN - Acceptable
- Grants non-exclusive, worldwide license
- Includes affiliate usage rights
- Standard use restrictions

#### 2. LIMITATION OF LIABILITY (Section 8)
RED - Must Negotiate
Current: "Vendor's liability shall not exceed $10,000"
Issue: Cap is far below contract value ($150,000 ACV)
Playbook Position: Minimum 12 months fees ($150,000)

**Suggested Redline**:
"Vendor's liability shall not exceed ~~$10,000~~ the greater
of (a) fees paid in the twelve (12) months preceding the
claim or (b) $150,000."

#### 3. INDEMNIFICATION (Section 7)
YELLOW - Should Negotiate
Current: IP indemnity excludes "modifications by Customer"
Issue: Overly broad exclusion could limit protection
Playbook Position: Narrow exclusions to material modifications

**Suggested Redline**:
Add: "provided such modification materially alters the
functionality of the Service in a manner not contemplated
by the Documentation"

### NEGOTIATION PRIORITIES
1. RED Liability Cap (critical gap)
2. RED Data Breach Indemnity (missing entirely)
3. YELLOW Indemnity Exclusions (overbroad)
4. YELLOW Termination Notice (60 vs 30 days)
5. GREEN Auto-renewal period (acceptable at 30 days)

### CUMULATIVE RISK SCORE: 7 (HIGH)
Recommend: Partner review before signing

/triage-nda

## NDA TRIAGE RESULTS

**Document**: Acme Corp Mutual NDA (v2.1)
**Type**: Mutual Non-Disclosure Agreement
**Direction**: Two-way protection

### TRIAGE RESULT: COUNSEL REVIEW

**Reason**: Contains 2 non-standard provisions requiring attorney review

### FLAGGED ITEMS:

1. **Non-Solicit Clause (Section 6)**
   - Not typically included in standard NDA
   - 24-month restriction on hiring
   - May need business approval

2. **Jurisdiction (Section 9)**
   - Specifies Texas courts exclusive jurisdiction
   - Our standard: Delaware or mutual agreement
   - Acceptable but note for negotiation if sensitive deal

### STANDARD ITEMS (No Issues):
- Definition of Confidential Information
- Mutual obligations
- 3-year term
- Standard exclusions
- Return/destruction requirement

### RECOMMENDATION:
Route to associate for 15-minute review of flagged items.
If non-solicit is acceptable to business, can proceed.

/vendor-check [vendor name]

/vendor-check Salesforce

## VENDOR STATUS: Salesforce

**Active Agreements**:
1. Master Subscription Agreement - Expires: Dec 2026
2. Data Processing Addendum - Current
3. Professional Services SOW #3 - Completed

**Upcoming**:
- Renewal negotiation due: October 2026
- Auto-renewal date: November 15, 2026

**Historical Notes**:
- Last negotiated liability cap increase (2024)
- Standard DPA accepted without modification

**Recommended Actions**:
- Begin renewal prep 90 days out (September 2026)
- Review new AI features for data processing implications

/brief [type] [topic/context]

/brief incident data-breach-notification

## INCIDENT RESPONSE BRIEF: Data Breach Notification

**Prepared**: [Date/Time]
**Classification**: Attorney-Client Privileged

### IMMEDIATE ACTIONS (0-24 Hours)
1. Preserve all relevant logs and communications
2. Engage incident response team
3. Notify cyber insurance carrier
4. Begin notification timeline tracking

### NOTIFICATION REQUIREMENTS BY JURISDICTION

**Federal**:
- HIPAA: 60 days (if PHI involved)
- GLBA: "As soon as reasonably practicable"
- SEC: 4 business days (material events, public companies)

**State Requirements** (Selected):
| State | Deadline | AG Notice? | Content Requirements |
|-------|----------|------------|---------------------|
| CA | "Expedient" | Yes >500 | Specific format |
| NY | "Most expedient" | Yes | Format specified |
| TX | 60 days | Yes >250 | Toll-free number |

### TEMPLATE RESOURCES
- Customer notification template: [Link]
- AG notification template: [Link]
- Board briefing outline: [Link]

### KEY CONTACTS
- Outside Counsel: [Name, Number]
- Forensics Vendor: [Name, Number]
- PR/Communications: [Name, Number]

/respond [request-type]

/respond dsar

## DATA SUBJECT ACCESS REQUEST RESPONSE

**Template Version**: 2.1 (GDPR/CCPA Compliant)

---

Dear [Requestor Name],

We are writing in response to your data subject access request
dated [Request Date]. We have verified your identity and are
pleased to provide the following information:

**Personal Data We Hold About You:**

| Category | Data Elements | Source | Purpose |
|----------|---------------|--------|---------|
| Identity | [Name, Email] | [Source] | [Purpose] |
| [Continue for all categories] |

**Third Parties With Whom Data Was Shared:**
- [List recipients and purposes]

**Your Rights:**
You have the right to:
- Request correction of inaccurate data
- Request deletion (subject to legal retention requirements)
- Object to processing for certain purposes
- Data portability in machine-readable format

**How to Exercise Additional Rights:**
Contact our Privacy Team at [privacy@company.com]

We must retain certain data for [legal/regulatory reasons].
Please see attached schedule for applicable retention periods.

If you have concerns about our handling of your data, you may
contact [relevant supervisory authority].

Sincerely,
[Company Name] Privacy Team

---

**Internal Notes** (Do not include in response):
- Verify identity before sending
- Log request in DSAR tracker
- 30-day response deadline: [Date]
- Fees applicable: No (first request)