TODO — make this yours. This is a generic starting template. Edit it to fit your own legal operation: your negotiation playbook and risk thresholds, your jurisdictions and applicable regulations, your escalation path to outside counsel, and your canned-response templates. Delete what you don't use.

Legal Ops

Contract & NDA Review

Contract Review Methodology

1. Identify the contract type: SaaS agreement, professional services, license, partnership, procurement, etc. — this affects which clauses are most material.
2. Determine the user's side: Vendor, customer, licensor, licensee, partner. This fundamentally changes the analysis (e.g., limitation-of-liability protections favor different parties depending on side).
3. Read the entire contract before flagging issues — clauses interact (an uncapped indemnity may be partially mitigated by a broad limitation of liability).
4. Analyze each material clause against the playbook position.
5. Consider the contract holistically: is the overall risk allocation and commercial balance reasonable?

Common Clause Analysis

Deviation Severity Classification

Redline Generation

1. Be specific — exact, insert-ready language, not vague guidance.
2. Be balanced — firm on critical points, commercially reasonable elsewhere; overly aggressive redlines slow negotiations.
3. Explain the rationale — 1-2 sentences suitable for sharing with counterparty's counsel.
4. Provide fallback positions for YELLOW items.
5. Prioritize — indicate must-haves vs. nice-to-haves.
6. Consider the relationship — adjust tone/approach for new vendor vs. strategic partner vs. commodity supplier.

**Clause**: [Section reference and clause name]
**Current language**: "[exact quote from the contract]"
**Proposed redline**: "[specific alternative language]"
**Rationale**: [1-2 sentences, suitable for external sharing]
**Priority**: [Must-have / Should-have / Nice-to-have]
**Fallback**: [Alternative position if primary redline is rejected]

Negotiation Priority Framework

• Tier 1 — Must-Haves (deal breakers): uncapped/materially insufficient liability protections; missing data protection for regulated data; IP provisions jeopardizing core assets; terms conflicting with regulatory obligations.
• Tier 2 — Should-Haves (strong preferences): liability cap adjustments within range; indemnification scope/mutuality; termination flexibility; audit and compliance rights.
• Tier 3 — Nice-to-Haves (concession candidates): preferred governing law (if alternative acceptable); notice-period preferences; minor definitional improvements; insurance certificate requirements.

NDA Screening Checklist

1. Agreement structure: type (mutual / unilateral-disclosing / unilateral-receiving) appropriate for the relationship; standalone agreement, not a confidentiality clause buried in a bigger contract.
2. Definition of Confidential Information: reasonably scoped (not "all information of any kind"); workable marking requirement if any (30 days from oral disclosure is standard); standard exclusions present; no problematic inclusions (public info, independently developed materials).
3. Receiving-party obligations: reasonable standard of care; use restricted to stated purpose; disclosure restricted to need-to-know parties under similar obligations; no impractical requirements (e.g., encrypt all communications, physical logs).
4. Standard carveouts (all must be present): public knowledge; prior possession; independent development; rightful third-party receipt; legal compulsion (with notice where permitted).
5. Permitted disclosures: employees; contractors/advisors/consultants under similar confidentiality; affiliates if needed; legal/regulatory.
6. Term and duration: agreement term 1-3 years standard; survival 2-5 years standard (longer for trade secrets); not perpetual.
7. Return and destruction: triggered on termination or request; reasonable scope; retention exception for legal/compliance/backup copies; certification (not sworn affidavit) is reasonable.
8. Remedies: injunctive relief acknowledgment is standard; no liquidated damages; mutual application.
9. Problematic provisions to flag: non-solicitation, non-compete, exclusivity, standstill (unless M&A context), broad residuals clause, IP assignment/license, audit rights — none of these belong in a standard NDA.
10. Governing law/jurisdiction: well-established commercial jurisdiction; consistent with governing law; no mandatory arbitration in standard NDAs.

NDA Classification Rules

Common NDA Issues and Standard Positions

NDA Routing Table

Compliance & Privacy

Privacy Regulation Overview

DPA Review Checklist

Data Subject Request Handling

1. Identify request type — access, rectification, erasure, restriction, portability, objection, opt-out of sale/sharing (CCPA/CPRA), limit use of sensitive PI (CPRA).
2. Identify applicable regulation(s) based on the data subject's location and the organization's presence/activities.
3. Verify identity proportionately to data sensitivity; don't over-demand documentation.
4. Log: date received, request type, requester identity, applicable regulation, response deadline, assigned handler.

Regulatory Monitoring

Legal Risk Assessment

Severity x Likelihood Framework

                    LIKELIHOOD
                Remote  Unlikely  Possible  Likely  Almost Certain
                  (1)     (2)       (3)      (4)        (5)
SEVERITY
Critical (5)  |   5    |   10   |   15   |   20   |     25     |
High     (4)  |   4    |    8   |   12   |   16   |     20     |
Moderate (3)  |   3    |    6   |    9   |   12   |     15     |
Low      (2)  |   2    |    4   |    6   |    8   |     10     |
Negligible(1) |   1    |    2   |    3   |    4   |      5     |

Risk Classification and Actions

Risk Assessment Memo Format

## Legal Risk Assessment

**Date**: [assessment date]
**Assessor**: [person conducting assessment]
**Matter**: [description of the matter being assessed]
**Privileged**: [Yes/No]

### 1. Risk Description
### 2. Background and Context
### 3. Risk Analysis
#### Severity Assessment: [1-5] - [Label]  (rationale: financial, operational, reputational)
#### Likelihood Assessment: [1-5] - [Label]  (rationale: precedent, triggers, current conditions)
#### Risk Score: [Score] - [GREEN/YELLOW/ORANGE/RED]
### 4. Contributing Factors
### 5. Mitigating Factors
### 6. Mitigation Options
| Option | Effectiveness | Cost/Effort | Recommended? |
### 7. Recommended Approach
### 8. Residual Risk
### 9. Monitoring Plan
### 10. Next Steps
1. [Action item - Owner - Deadline]

Risk Register Entry

When to Engage Outside Counsel

Meeting Briefings

Prep Methodology

1. Identify the meeting: title/type (deal review, board, vendor call, team sync, client meeting, regulatory discussion), participants and their roles/interests, agenda, the user's role (advisor/presenter/observer/negotiator), and available prep time.
2. Assess prep needs by meeting type:

1. Gather context from connected sources: Calendar (meeting details, prior meetings with same attendees in last 3 months, related follow-ups, competing commitments); Email (recent correspondence, prior follow-up threads, open action items, shared documents); Chat (recent discussions, messages from/about participants, relevant decisions); Documents (agendas, prior notes, agreements/memos, draft materials); CLM (relevant contracts, status, approval workflow, amendment/renewal history); CRM (account/opportunity info, relationship history, deal stage, stakeholder map).
2. Synthesize into the briefing template (below).
3. Identify prep gaps: unavailable sources, outdated info, unanswered questions, documents that couldn't be located.

Briefing Template

## Meeting Brief

### Meeting Details
- Meeting / Date-Time / Duration / Location / Your Role

### Participants
| Name | Organization | Role | Key Interests | Notes |

### Agenda / Expected Topics
1. [Topic] - [brief context]

### Background and Context
[2-3 paragraph summary: relevant history, current state, why this meeting is happening]

### Key Documents
- [Document] - [description and location]

### Open Issues
| Issue | Status | Owner | Priority | Notes |

### Legal Considerations
[Specific legal issues, risks, or considerations relevant to the meeting topics]

### Talking Points
1. [Key point, with supporting context]

### Questions to Raise
- [Question] - [why this matters]

### Decisions Needed
- [Decision] - [options and recommendation]

### Red Lines / Non-Negotiables
[If a negotiation meeting: positions that cannot be conceded]

### Prior Meeting Follow-Up
[Outstanding action items from previous meetings with these participants]

### Preparation Gaps
[Info that could not be found or verified; questions for the user]

Meeting-Type Additions

• Deal Review: deal summary (parties, value, structure, timeline); contract status in review/negotiation with outstanding issues; approval requirements; counterparty dynamics (likely positions, recent communications, relationship temperature); comparable deals.
• Board/Committee: legal department update (matters, wins, new/closed matters); risk highlights from the risk register with changes since last report; regulatory update; pending resolutions/approvals; litigation summary (active matters, reserves, settlements, new filings).
• Regulatory: which regulator/division and current enforcement priorities; matter history (prior interactions, submissions, correspondence timeline); current compliance posture; outside counsel coordination and prior advice; privilege considerations (what can/cannot be discussed).

Action Item Tracking

## Action Items from [Meeting Name] - [Date]

| # | Action Item | Owner | Deadline | Priority | Status |

Canned & Templated Responses

Template Management

Response Categories

Subject: Your Data [Access/Deletion/Correction] Request - Reference {{request_id}}

Dear {{requester_name}},

We have received your request dated {{request_date}} to [access/delete/correct] your
personal data under [applicable regulation].

[Acknowledgment / verification request / fulfillment details / denial basis]

We will respond substantively by {{response_deadline}}.

[Contact information] [Rights information]

Subject: LEGAL HOLD NOTICE - {{matter_name}} - Action Required
PRIVILEGED AND CONFIDENTIAL / ATTORNEY-CLIENT COMMUNICATION

Dear {{custodian_name}},

You may possess documents, communications, or data relevant to the matter above.

PRESERVATION OBLIGATION: Effective immediately, preserve all documents and ESI related to:
- Subject matter: {{hold_scope}}
- Date range: {{start_date}} to present
- Document types: {{document_types}}

DO NOT delete, destroy, modify, or discard potentially relevant materials.
[System/email/chat/local-file instructions]

Acknowledge receipt by {{acknowledgment_deadline}}. Contact {{legal_contact}} with questions.

Customization Guidelines

Escalation Trigger Identification

• DSRs: request from/on behalf of a minor; data subject to a litigation hold; requester in active litigation/dispute with the org; requester is an employee with an active HR matter; scope suggests a fishing expedition; involves special category data (health, biometric, genetic).
• Discovery holds: potential criminal liability; unclear/disputed preservation scope; conflicts with regulatory deletion requirements; prior holds exist for related matters; custodian objects to scope.
• Vendor questions: vendor disputing contract terms; vendor threatening litigation/termination; response could affect an ongoing negotiation; involves regulatory compliance, not just contract interpretation.
• Subpoena/legal process: always requires counsel review; privilege issues; third-party data involved; cross-border production issues; unreasonable timeline.

Creating a New Template

1. Define the use case (inquiry type, frequency, audience, urgency).
2. Identify required elements (mandatory info, regulatory requirements, org policies).
3. Define variables — what changes each use ({{requester_name}}, {{response_deadline}}, {{matter_reference}}) vs. what stays fixed.
4. Draft in clear, professional language; avoid unneeded jargon for business audiences; include all legally required elements; add a subject-line template for email use.
5. Define escalation triggers — specific, not vague.
6. Add metadata: name/category, version, last-reviewed date, author/approver, follow-up actions checklist.

## Template: {{template_name}}
**Category**: {{category}}
**Version**: {{version}} | **Last Reviewed**: {{date}}
**Approved By**: {{approver}}

### Use When
- [Condition 1]

### Do NOT Use When (Escalation Triggers)
- [Trigger 1]

### Variables
| Variable | Description | Example |

### Subject Line
[Subject template with {{variables}}]

### Body
[Response body with {{variables}}]

### Follow-Up Actions
1. [Action 1]

### Notes
[Any special instructions]