The documents customers, regulators and auditors expect, and where the obligation comes from. Lekha generates these as part of the 180+ document library; Dharma checks you hold the right ones.
Privacy Policy
Tells data subjects what personal data you collect, why, how long you keep it and their rights.
Required by: GDPR Art. 13 to 14, UK GDPR, DPDP Act 2023 s.5, CCPA / CPRA, LGPD, PIPEDA, Singapore PDPA, FADP
Cookie and Tracking Policy
Discloses cookies, pixels and trackers, their purpose and how users control them.
Required by: EU ePrivacy Directive, GDPR consent, CCPA / CPRA opt-out, LGPD
Consent Notice and Form
Captures free, specific, informed, withdrawable consent and logs a record of it.
Required by: GDPR Art. 7, DPDP Act 2023 s.6, CCPA opt-in for minors, LGPD
Data Processing Agreement (DPA)
Contract binding a processor or vendor to handle personal data on your documented instructions.
Required by: GDPR Art. 28, DPDP processor duties, CCPA service-provider terms, Standard Contractual Clauses
Records of Processing Activities (RoPA)
Internal register of every processing activity, its purpose, categories and retention.
Required by: GDPR Art. 30, accountability principle, DPDP record-keeping
Data Subject Request (DSAR) Procedure
How you receive, verify and answer access, correction, erasure and portability requests.
Required by: GDPR Art. 15 to 22, CCPA / CPRA consumer rights, DPDP Act 2023 s.11 to 13
Data Breach Notification
Playbook and templates for notifying regulators and affected people inside the legal window.
Required by: GDPR Art. 33 to 34 (72 hours), DPDP breach reporting, US state breach laws, CCPA
Data Protection Impact Assessment (DPIA)
Risk assessment for high-risk processing, profiling or large-scale or sensitive data.
Required by: GDPR Art. 35, ICO guidance, ISO 27701 alignment
Terms of Service
The contract between you and your users: scope, payment, liability, dispute resolution.
Required by: Contract and consumer-protection law, platform and app-store rules
End-User License Agreement (EULA)
Licence terms for installed or downloadable software, protecting your IP and limiting liability.
Required by: Software licensing and copyright law, distribution-platform rules
Refund and Cancellation Policy
Sets out when and how customers can cancel, return or be refunded.
Required by: Consumer-protection and distance-selling rules, payment-provider requirements
Acceptable Use Policy
Defines permitted and prohibited use of your service and the consequences of misuse.
Required by: Contract law, ISO 27001 A.5, SOC 2 security criteria
Accessibility Statement
Declares your target standard, current conformance and how users report barriers.
Required by: ADA Title II / WCAG 2.1 AA (US deadline Apr 2026), EU Accessibility Act, Section 508
AI Use and Disclosure Notice
Tells users where AI is used, what it does and how decisions can be questioned.
Required by: EU AI Act transparency, FTC guidance, NIST AI RMF, US state AI disclosure laws