Skip to content
cccskills
FreePublished on GitHub

privacy-law-gap-analysis

Guides conducting privacy law gap analysis for market entry into new jurisdictions. Covers target jurisdiction assessment, existing compliance mapping, remediation effort estimation, and implementation timeline planning. Keywords: gap analysis, market entry, jurisdiction assessment, remediation planning, compliance mapping.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

  • SKILL.md9.0 KB
  • assets/template.md1.5 KB
  • references/standards.md3.1 KB
  • references/workflows.md3.1 KB
  • scripts/process.py7.5 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Privacy Law Gap Analysis for Market Entry

Overview

When an organisation enters a new market, it must assess the target jurisdiction's privacy requirements against its existing compliance posture. A structured gap analysis identifies what additional controls, policies, and procedures are needed to achieve compliance before commencing operations. This skill provides a repeatable methodology for conducting such assessments, estimating remediation effort, and planning implementation timelines.

Gap Analysis Methodology

Phase 1: Target Jurisdiction Assessment

Step 1 — Regulatory Landscape Mapping

Assessment ElementQuestions to Answer
Primary data protection lawWhat is the comprehensive data protection statute? When was it enacted and last amended?
RegulatorWhich authority enforces the law? What is its enforcement track record?
ScopeDoes the law have extraterritorial reach? What activities trigger applicability?
Registration/notificationIs regulatory registration or notification required before processing?
Local representativeIs a local representative or establishment required?
DPO requirementMust a Data Protection Officer be appointed? What qualifications are needed?
Sector-specific rulesAre there additional sector-specific requirements (financial, health, telecom)?

Step 2 — Requirement Extraction

Extract detailed requirements across 12 compliance domains:

  1. Lawful basis: Available bases; consent requirements; legitimate interest availability
  2. Individual rights: Catalogue of rights; response deadlines; format requirements
  3. Consent management: Form requirements; withdrawal mechanism; children's consent; sensitive data consent
  4. Notice and transparency: Content requirements; language requirements; timing; format
  5. Cross-border transfers: Mechanisms; adequacy status; data localisation requirements
  6. DPO and governance: Appointment criteria; qualifications; reporting structure
  7. Breach notification: Timeline; threshold; content; authority and individual notification
  8. Impact assessment: Triggers; content; retention; review frequency
  9. Security safeguards: Minimum standards; encryption requirements; access control
  10. Retention and deletion: Limitation principles; destruction timelines; methods
  11. Enforcement and penalties: Administrative fines; criminal penalties; civil liability
  12. Record-keeping: Processing records; consent records; transfer records; breach records

Phase 2: Existing Compliance Mapping

Step 1 — Inventory Current Controls

Control CategoryInventory Items
PoliciesPrivacy policy, cookie policy, employee privacy notice, vendor privacy requirements
ProceduresDSR response, breach notification, DPIA, consent management, data deletion
Technical controlsEncryption, access control, logging, DLP, anonymisation/pseudonymisation
Organisational controlsDPO, privacy team, training programme, governance committee
Contractual controlsDPA templates, SCC templates, vendor agreements, intra-group agreements
RecordsProcessing register, consent records, transfer register, breach log

Step 2 — Map Current Controls to Target Requirements

For each target jurisdiction requirement, assess:

  • Fully met: Existing control satisfies the requirement without modification
  • Partially met: Existing control addresses the requirement but needs enhancement
  • Not met: No existing control addresses the requirement; new control needed
  • Not applicable: Requirement does not apply to the organisation's planned activities

Phase 3: Gap Identification and Prioritisation

Gap Classification

ClassificationDefinitionPriorityRemediation Timeline
CriticalLegal requirement with no existing control; enforcement risk is highP1Before market entry
SignificantLegal requirement partially met; enhancement needed to avoid enforcement riskP2Within 90 days of market entry
MinorBest practice or low-enforcement-risk requirement not fully metP3Within 180 days of market entry
EnhancementExisting control meets requirement but could be optimisedP4Next annual review cycle

Phase 4: Remediation Planning

Remediation Effort Estimation

Effort CategorySmallMediumLarge
Policy drafting/update1-2 weeks2-4 weeks4-8 weeks
Procedure development1-2 weeks2-6 weeks6-12 weeks
Technical implementation2-4 weeks4-8 weeks8-16 weeks
Training development and delivery1-2 weeks2-4 weeks4-8 weeks
Vendor/contract update2-4 weeks4-8 weeks8-16 weeks
Regulatory registration/filing1-4 weeks4-8 weeks8-24 weeks

Phase 5: Timeline Planning

Standard Market Entry Privacy Timeline

WeekActivityDeliverable
1-2Regulatory landscape mappingJurisdiction assessment report
3-4Requirement extractionDetailed requirements document
5-6Current control mappingControl inventory and mapping
7-8Gap analysisGap report with classifications
9-10Remediation planningRemediation plan with effort estimates
11-14P1 critical gap remediationUpdated policies, procedures, technical controls
15-18P2 significant gap remediationEnhanced controls and procedures
19-20Training and awarenessStaff training completion
21-22Pre-launch compliance reviewCompliance readiness assessment
23-24Go-live with monitoringMarket entry with active compliance monitoring

Example: Zenith Global Enterprises — Vietnam Market Entry

Jurisdiction Assessment Summary

ElementDetail
LawDecree 13/2023/ND-CP on Personal Data Protection (effective 1 July 2023)
RegulatorMinistry of Public Security (MPS) — Department of Cybersecurity and Hi-tech Crime Prevention
ScopeAll personal data processing in Vietnam; extraterritorial for activities targeting Vietnamese individuals
DPO requirementRequired for certain processors (large-scale sensitive data processing)
Cross-border transferMandatory impact assessment dossier; file with MPS before first transfer
Breach notification72 hours to MPS
Key unique requirementsTransfer impact assessment dossier filed with MPS; consent required as primary basis

Gap Analysis Results

DomainCurrent StatusGap ClassificationRemediation
Lawful basisGDPR-compliant consent frameworkPartially met — Vietnam consent requirements differP2: Adapt consent forms for Vietnam-specific requirements
Individual rightsGlobal DSR portalPartially met — Vietnamese language requiredP2: Add Vietnamese language support
Cross-border transferEU SCCs in placeNot met — Vietnam requires MPS-filed impact dossierP1: Prepare and file transfer impact assessment dossier
DPOGlobal DPO structurePartially met — local representative may be neededP2: Assess and appoint local privacy contact
Breach notification72-hour global standardFully metNo gap
Privacy noticeMulti-language noticesPartially met — Vietnamese language neededP2: Translate and localise privacy notice
SecurityISO 27001 certifiedFully metNo gap
TrainingAnnual global programmeNot met — Vietnam-specific content neededP2: Develop Vietnam PDPD module

Remediation Timeline

WeekActivityPriority
1-2Prepare transfer impact assessment dossierP1
3-4File dossier with MPSP1
5-6Adapt consent forms and privacy notice (Vietnamese)P2
7-8Add Vietnamese to DSR portalP2
9-10Appoint local privacy contactP2
11-12Develop and deliver Vietnam training moduleP2
13-14Pre-launch compliance reviewFinal check

Gap Analysis Governance

ElementDetail
Gap analysis ownerChief Privacy Officer
ApprovalPrivacy Steering Committee sign-off on remediation plan
TrackingGap remediation tracked in GRC platform
ReviewPost-entry review at 90 days to verify all gaps remediated
ReuseGap analysis template stored for future market entries

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill