Use this after the processing record changes, before a product launch, after vendor changes, or on the privacy programme's review cadence. You get three documents in a new folder, ./privacy-notice-gap-check/: a list of every place the company collects personal data and which notice covers it (collection-points.md), a table of what the notice gets right, misses or gets wrong (gap-matrix.md), and a marked-up draft of the notice changes, old text next to new (notice-redline.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The privacy lead or counsel approves any change to a published notice.

Inputs to gather

Read every notice in use: the website and product privacy notice, the cookie notice, and the notices for employees, candidates and event or newsletter audiences. Read the record of processing activities, the vendor and sub-processor lists, sign-up and contact forms, and the consent tool configuration. Ask the reader, in one message: which collection points exist outside the website (sales events, purchased or enriched lead lists, partner referrals, phone support), which countries the audiences are in, and whether the processing record is current.

Step 1: map the collection points

In the collection list (collection-points.md), list every place personal data enters the company: account sign-up, contact and demo forms, newsletter, checkout, product telemetry, support channels, job applications, events, data received from customers, partners or data providers. For each, note who the people are, whether data comes from them directly or from another source, which notice covers it, and how the notice is surfaced (a link at the point of collection, or buried in a footer). Data obtained from someone other than the person falls under Article 14 of the GDPR rather than Article 13, which brings the source of the data and the timing of the information into play; mark those points clearly, because they are the most often forgotten. Check the timing too: Article 14(3) sets a reasonable period of at most one month after obtaining the data, earlier at the first communication or disclosure, and Article 14(5) holds the narrow exemptions. Note any collection point that may reach children, and the national consent age under Article 8 that applies there.

Step 2: check what the site and product really collect

With the reader, open the public site and the product in a browser and use its developer tools to list cookies, local storage and third-party requests on first load, before any consent choice, and again after accepting and after refusing. Compare with the cookie notice and the vendor list. Trackers that fire before consent are a practice problem, not a wording problem; route them to the consent tool owner. Check the consent tool as a record too: choices are logged, refusing is as easy as accepting, and withdrawal is as easy as giving consent (Article 7(3)). Non-essential cookies need consent under the ePrivacy rules whatever legal basis the notice claims.

Step 3: build the gap matrix

In the gap table (gap-matrix.md), rows are processing activities from the record and collection points from Step 1. Columns are the information items Articles 13 and 14 list, such as purposes and legal basis, the legitimate interest where relied on, recipients, transfers and their safeguard, retention, rights including withdrawing consent and complaining to a supervisory authority, automated decision-making, and for Article 14 the categories and source of the data. Mark each cell: