Some of the items in your document seem more like non-functional requirements that I would expect to find in a specification, not a design document,e.g., security, privacy, legal.

If they constrain design they're relevant. Doesn't mean every legal detail should be in the doc.