Playbook: SaaS

SEC reporting: Exchange Act §13(a) and Form 8-K Item 1.05

Applies to SEC registrants in every industry.

Åtgärder: Disclosure committee and escalation path, Filing calendar by filer status, Sub-certifications supporting CEO and CFO certifications, Incident materiality assessment playbook, Security incident escalation to disclosure counsel, Item 1.05 drafting template and amendment tracker

California Consumer Privacy Act as amended by CPRA

Fintech: GLBA-covered data partly exempt (§1798.145(e)). Healthcare: HIPAA protected health information exempt (§1798.146).

Åtgärder: Notice at collection, Retention schedule per category, Purpose and compatibility register, CCPA contract terms with vendors, Tracking technology inventory, Reasonable security program, Deletion request intake and verification, Deletion propagated to vendors and third parties, Confidential suppression list, Documented deletion exceptions, "Do Not Sell or Share" link and notice, Global Privacy Control honoured, Age signals and opt-in for under 16, Opt-out passed to ad tech and third parties

FTC Act §5: unfair or deceptive acts or practices

Banks and common carriers are outside FTC §5 jurisdiction; fintechs that are not banks are covered.

Åtgärder: Substantiation file for marketing and AI capability claims, Pre-deployment testing and monitoring of AI systems for accuracy and bias, Written information security program, Consent and cancellation flow review

Children's Online Privacy Protection Rule (16 CFR Part 312)

Applies to services directed to children or with actual knowledge of child users.

Åtgärder: Neutral age screening and audience assessment, Verifiable parental consent mechanism, Security program for children's data, Written retention and deletion policy for children's data

Copyright Act §107 fair use

Relevant where products reproduce or train on third-party works.

Åtgärder: Lawful acquisition and provenance of source works, Documented transformative purpose, Output filtering against reproduction of protected expression, Market substitution review, Licence and permissions register, Rights holder request and removal process