GDPR Compliance Gap Assessment
GDPR compliance gap assessment for practical privacy priorities
EU customer requirements and international expansion can expose gaps between privacy policies and daily operations. ICA’s scoped review examines privacy governance, personal-data handling and security practices to inform processing-documentation recommendations and a remediation roadmap.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Turn privacy concerns into decisions about the work ahead
An EU customer asks how you handle personal data. A new market introduces unfamiliar privacy responsibilities. Internally, different teams give different answers about retention or request handling. Your privacy officer, compliance lead and CISO need a shared view of the gaps before assigning work.
It examines the agreed privacy operations and the evidence behind them, so leadership can distinguish documentation needs from process weaknesses. Counsel validates GDPR applicability and legal interpretations; the assessment helps your operational teams decide where to focus improvement.
Define coverage around how personal data moves
Scope starts with the processing activities under review, relevant jurisdictions and your organization’s roles. Discuss which business units collect personal data, why they use it, where it is kept and who receives it. Customer-service workflows may need different evidence from employee or supplier processes.
Coverage can include privacy ownership, notices, retention practices, individual-rights request handling and security practices supporting those activities. The review also considers how teams document sharing and escalate privacy concerns. These topics reflect GDPR’s focus on transparent handling, purpose, appropriate protection and accountability. Agree the selected workflows and evidence depth before treating the findings as representative of a wider organization.
Compare documented processes with operational evidence
The proposed approach combines interviews with evidence review. Privacy and compliance stakeholders explain responsibilities; IT and business-process owners describe how personal data is handled in practice. Relevant materials may include processing records, policies, notices, retention schedules and examples of completed request-handling records.
Compare stated procedures with available evidence. A policy might describe deletion while the responsible team cannot show how it happens. That difference deserves attention in the findings. The review should also distinguish missing evidence from an observed process weakness. This is an operational and documentation review; vulnerability scanning, configuration testing and penetration testing require separate scope.
Use the findings to organize privacy improvements
The catalog identifies three typical outputs, with their detail agreed for the engagement:
Gap assessment. A documented account of findings within the agreed coverage. Use it to explain where privacy governance, handling practices or operational processes need attention.
Processing-documentation recommendations. Advice on improving how your team describes processing activities and maintains supporting documentation. These recommendations help owners identify incomplete records and inconsistencies that need resolution.
Remediation roadmap. A sequence of recommended improvements for planning. Leadership can use it to discuss priorities and assign responsibility for the work.
Prepare the people and evidence that establish scope
Identify the business reason for the review and the processing activities that matter most. Include stakeholders who understand privacy governance and the selected workflows, alongside counsel for legal questions.
Cost and timing depend on the number of entities and jurisdictions, processing complexity, interview needs and evidence availability. Agree the deliverable depth and client participation before work begins. Establish suitable evidence-access and handling arrangements for the engagement. Redacted examples may be sufficient for some process reviews; agree what is necessary rather than assuming full personal-data records must be shared.
Keep assessment findings and legal conclusions distinct
Counsel validates applicability and legal interpretations, including questions about organizational roles and particular processing activities. The assessment provides scoped gap findings and improvement recommendations. It does not issue GDPR certification or establish automatic full compliance.
A broader cybersecurity program review focuses on security governance and risk across the program. This assessment concentrates on privacy operations and personal-data handling within its agreed boundary. The roadmap recommends work; implementing changes, drafting final legal documents or operating an ongoing privacy function requires separately agreed scope.
GDPR gap assessment questions
Who is this assessment intended for?
Privacy officers, compliance leads and CISOs in internationally active businesses facing EU customer requests, expansion or operational privacy gaps. Counsel should validate whether GDPR applies to the relevant activities; international business alone does not settle that question.
Can we focus on one product or business unit?
A defined processing boundary can guide the review. Agree the relevant workflows and organizational roles, then identify dependencies outside that boundary. A focused assessment should not be represented as a conclusion about every processing activity in the organization.
What evidence is useful if our privacy records are incomplete?
Available policies and processing descriptions provide a starting point. Interviews with process owners and redacted examples of operational records can help explain actual practice. Missing documentation is itself useful information for the processing-documentation recommendations.
What affects assessment cost and timing?
Processing complexity, jurisdictional coverage and the number of participating teams influence the effort. Evidence accessibility and the agreed depth of review also matter.
How does this differ from a security assessment?
This review addresses privacy governance and personal-data operations alongside supporting security practices. A technical security assessment examines a different evidence base. Scanning or testing systems is separate from the interview-and-document approach described here.
Will the roadmap implement the changes or certify compliance?
The roadmap recommends improvements for your team to plan and carry out. Implementation requires a separate agreement. This assessment does not provide GDPR certification, and counsel remains responsible for validating the legal interpretations used in decisions.
Define the privacy review your business needs
Discuss the customer requirement, expansion plan or operational gap driving your review. A clearly bounded GDPR assessment gives your privacy and security owners a basis for examining findings, improving processing documentation and planning remediation.
Turn privacy concerns into decisions about the work ahead
An EU customer asks how you handle personal data. A new market introduces unfamiliar privacy responsibilities. Internally, different teams give different answers about retention or request handling. Your privacy officer, compliance lead and CISO need a shared view of the gaps before assigning work.
It examines the agreed privacy operations and the evidence behind them, so leadership can distinguish documentation needs from process weaknesses. Counsel validates GDPR applicability and legal interpretations; the assessment helps your operational teams decide where to focus improvement.
Define coverage around how personal data moves
Scope starts with the processing activities under review, relevant jurisdictions and your organization’s roles. Discuss which business units collect personal data, why they use it, where it is kept and who receives it. Customer-service workflows may need different evidence from employee or supplier processes.
Coverage can include privacy ownership, notices, retention practices, individual-rights request handling and security practices supporting those activities. The review also considers how teams document sharing and escalate privacy concerns. These topics reflect GDPR’s focus on transparent handling, purpose, appropriate protection and accountability. Agree the selected workflows and evidence depth before treating the findings as representative of a wider organization.
Compare documented processes with operational evidence
The proposed approach combines interviews with evidence review. Privacy and compliance stakeholders explain responsibilities; IT and business-process owners describe how personal data is handled in practice. Relevant materials may include processing records, policies, notices, retention schedules and examples of completed request-handling records.
Compare stated procedures with available evidence. A policy might describe deletion while the responsible team cannot show how it happens. That difference deserves attention in the findings. The review should also distinguish missing evidence from an observed process weakness. This is an operational and documentation review; vulnerability scanning, configuration testing and penetration testing require separate scope.
Use the findings to organize privacy improvements
The catalog identifies three typical outputs, with their detail agreed for the engagement:
Gap assessment. A documented account of findings within the agreed coverage. Use it to explain where privacy governance, handling practices or operational processes need attention.
Processing-documentation recommendations. Advice on improving how your team describes processing activities and maintains supporting documentation. These recommendations help owners identify incomplete records and inconsistencies that need resolution.
Remediation roadmap. A sequence of recommended improvements for planning. Leadership can use it to discuss priorities and assign responsibility for the work.
Prepare the people and evidence that establish scope
Identify the business reason for the review and the processing activities that matter most. Include stakeholders who understand privacy governance and the selected workflows, alongside counsel for legal questions.
Cost and timing depend on the number of entities and jurisdictions, processing complexity, interview needs and evidence availability. Agree the deliverable depth and client participation before work begins. Establish suitable evidence-access and handling arrangements for the engagement. Redacted examples may be sufficient for some process reviews; agree what is necessary rather than assuming full personal-data records must be shared.
Keep assessment findings and legal conclusions distinct
Counsel validates applicability and legal interpretations, including questions about organizational roles and particular processing activities. The assessment provides scoped gap findings and improvement recommendations. It does not issue GDPR certification or establish automatic full compliance.
A broader cybersecurity program review focuses on security governance and risk across the program. This assessment concentrates on privacy operations and personal-data handling within its agreed boundary. The roadmap recommends work; implementing changes, drafting final legal documents or operating an ongoing privacy function requires separately agreed scope.
GDPR gap assessment questions
Who is this assessment intended for?
Privacy officers, compliance leads and CISOs in internationally active businesses facing EU customer requests, expansion or operational privacy gaps. Counsel should validate whether GDPR applies to the relevant activities; international business alone does not settle that question.
Can we focus on one product or business unit?
A defined processing boundary can guide the review. Agree the relevant workflows and organizational roles, then identify dependencies outside that boundary. A focused assessment should not be represented as a conclusion about every processing activity in the organization.
What evidence is useful if our privacy records are incomplete?
Available policies and processing descriptions provide a starting point. Interviews with process owners and redacted examples of operational records can help explain actual practice. Missing documentation is itself useful information for the processing-documentation recommendations.
What affects assessment cost and timing?
Processing complexity, jurisdictional coverage and the number of participating teams influence the effort. Evidence accessibility and the agreed depth of review also matter.
How does this differ from a security assessment?
This review addresses privacy governance and personal-data operations alongside supporting security practices. A technical security assessment examines a different evidence base. Scanning or testing systems is separate from the interview-and-document approach described here.
Will the roadmap implement the changes or certify compliance?
The roadmap recommends improvements for your team to plan and carry out. Implementation requires a separate agreement. This assessment does not provide GDPR certification, and counsel remains responsible for validating the legal interpretations used in decisions.
Define the privacy review your business needs
Discuss the customer requirement, expansion plan or operational gap driving your review. A clearly bounded GDPR assessment gives your privacy and security owners a basis for examining findings, improving processing documentation and planning remediation.