A GDPR gap analysis compares what your organisation actually does with personal data against what the law, and the regulator's guidance, expects, and lists the differences. That is all it is. It is not a pass or fail certificate, and it is not a fine in waiting. It is a map of where you are, so you can decide what to fix first.
Because people often fear a gap analysis will "find something", this article sets out what one looks at, the gaps that come up most often, what you receive at the end, and just as importantly, what it cannot tell you.
What a gap analysis looks at
A useful gap analysis covers the whole of how you handle personal data, not just the policies on the shelf. The ICO's Accountability Framework is a good guide to the ground: it groups good practice into areas such as leadership and oversight, policies, training, records of processing, contracts, risks and impact assessments, records management, breach response and monitoring. Its central message is that "accountability is also about what you actually do in practice", and that "the greater the risk, the more robust and comprehensive the measures in place should be."
In a typical review, that means:
- Who is responsible. Is someone clearly in charge of data protection, and does leadership know what is going on?
- What data you hold, and why. Is there a record of processing activities that reflects reality?
- Your lawful bases and notices. Do your privacy notices say what you do, and do you have a lawful basis for each purpose?
- Your suppliers. Do you know who processes data for you, and are there contracts?
- Your people. Do staff know what to do, and have they been trained?
- Your security and incident readiness. Could you spot, assess and report a breach in time?
- Individual rights. Can you handle access, deletion and objection requests?
- Retention and disposal. Do you keep data for a sensible period, and delete it?
- Risk assessment. Are DPIAs done where needed?
The gaps we most often expect to find
Every organisation is different, but these themes come up again and again in the kinds of cases that reach the regulator and the press:
- A record of processing that is out of date or does not exist. Often written once, never revisited.
- Suppliers without proper contracts. The Welsh "Password1" reprimands and many breach reports turn on a supplier relationship that nobody had pinned down.
- No retention schedule. Data is kept by default, not by decision.
- Privacy notices that no longer match practice. Tools and purposes change faster than the notice.
- Staff who have never been trained, or were trained once.
- Nobody owns the rights process. Subject access requests are handled ad hoc.
- No tested incident plan. The plan exists, but nobody knows where it is.
- Missing DPIAs for new tools. The tool arrived before the question was asked.
These are expectations from experience and the public enforcement record, not statistics, and your organisation may find none, some or others.
What you get at the end
A good gap analysis ends with something you can act on, not a long list of worries. Typically that means a short report that sets out what you do well, the gaps found, each rated by risk, and a prioritised action plan with suggested owners and timescales. The best ones separate "fix this month" from "fix this quarter" from "keep an eye on". A proportionate plan matters more than a complete one.
What a gap analysis does not do
- It does not certify you as compliant. No such certificate exists under UK GDPR. It is a snapshot against current expectations.
- It does not fix anything by itself. The value comes from acting on it.
- It does not guarantee you will never have an incident. It lowers the likelihood and prepares you to respond.
- It is not a legal opinion on a specific dispute. Where you have a live legal question, you need a lawyer.
- It does not stay accurate. New suppliers, tools and rules mean it needs refreshing, typically annually or after significant change.
A worked example
A 25-person charity commissions a gap analysis because a funder has asked about its data protection arrangements. The review finds that the charity's supporter database sits with a supplier whose contract has no data protection terms, that the privacy notice does not mention a text-message appeal it started last year, and that nobody has looked at who still has access to the shared drive. It also finds good things: a clear safeguarding record process, a named trustee for data protection and staff who answered questions confidently.
The action plan puts the contract and the access review in month one, the notice update in month two and a short training session in month three. The funder receives a plain summary and the trustees see where effort is going. (An invented example, for illustration.)
How to prepare for one
- Gather your privacy notices, key policies and any records of processing you have.
- List your main systems and suppliers, even roughly.
- Be honest with the reviewer. They are there to help, not to judge.
- Decide who will own the action plan before you start.
Frequently asked questions
How long does a gap analysis take? It depends on the size and complexity of your organisation. A small organisation may need a few days of involvement spread over a few weeks.
Do we need one if we have a data protection officer? Often yes: an independent view can see what people close to the work do not.
Will it be shared with the regulator? No, not by us. A gap analysis is a confidential, internal document. If you later choose to show it to a funder or regulator, that is up to you.
How often should we repeat it? Roughly every year, and after major changes such as a new system, a merger or a significant new use of data.
How Pathway 2 Privacy can help: a GDPR Gap Analysis gives you an independent, plain-English picture of where you stand and a prioritised plan. Policy Review, Training & Workshops or an Advisory Retainer can then help turn the plan into practice. See our GDPR support for small businesses and the "Password1" reprimands for a real example of what a review can catch. Or start with a free data protection review.
Sources: ICO Accountability Framework; The Register on the ICO's Welsh reprimands.
