Privacy Policy Gap Review

Privacy Policy Gap Review

Purpose

Produce a structured, attorney-ready gap review of a published privacy policy or privacy notice. The review identifies: missing standard disclosure topics, vague or boilerplate language that may not reflect actual practice, internal inconsistencies within the policy, and discrepancies between the policy's representations and the organization's actual data practices as described by the user. It produces draft legal work product for attorney review — not legal advice.

This skill provides structural and drafting analysis only. It does not certify compliance with any specific privacy law, regulation, or jurisdiction. Whether any identified gap constitutes a legal violation — and what remediation is legally required — are attorney-verification items. The applicable law, the organization's compliance posture, and the jurisdictional scope of the policy must be determined by counsel.

Use When

• A user asks to "review our privacy policy," "find gaps in this privacy notice," or "does our policy match what we actually do."
• An organization is updating its privacy policy and wants a first-pass review before attorney review and redrafting.
• A privacy audit or assessment requires a document review of the current privacy notice.
• An organization has changed its data practices (new vendor, new product feature, new data collection) and needs to identify whether the policy needs to be updated.
• Due diligence on a transaction requires review of the target's public-facing privacy representations.
• A regulator or counterparty has raised concerns about the organization's privacy policy and the legal team needs a structured analysis.
• The organization operates in multiple jurisdictions and wants to identify disclosure topics that may need to be addressed for different audiences [CONFIRM: applicable requirements with counsel].

Required Inputs

• The privacy policy or privacy notice text — uploaded, pasted, or linked. If not provided, stop and request it. Do not fabricate or assume policy terms.
• A description of the organization's actual data practices — what personal data is collected, from whom, for what purposes, who it is shared with, how it is processed, and how long it is retained. This description must come from the user; do not invent practices. If this description is not provided, the practice-versus-policy comparison step cannot be completed — note the gap and proceed with a structural review only, flagging the comparison as an open item.
• Optional: the organization's industry or sector (e.g., healthcare, financial services, children's services, e-commerce) — relevant for identifying sector-specific disclosure topics to flag, though applicable law is always [CONFIRM].
• Optional: the audience or jurisdictions the policy is intended to serve (e.g., EU residents, California residents, global) — used to identify disclosure topics commonly associated with those audiences, not to assert applicable law.
• Optional: a prior version of the policy, if this is a revision review.
• Optional: the practice group's practice-profiles/privacy.md if it has been populated and is loaded alongside this skill. If present, the skill uses its Standard Positions and Source-of-Truth Documents tables to benchmark the policy against the group's baseline policy template. If absent, the skill proceeds without practice-profile benchmarking and asks the user to supply standing positions inline if needed.