Some items in your doc seem more like non-functional requirements that I would expect to see in a specification, not a design document: e.g., security, privacy,

Some items in your doc seem more like non-functional requirements that I would expect to see in a specification, not a design document: e.g., security, privacy, legal.