Skip to main content
MethodLegal, Risk & ComplianceContracts & regulationAdvanced

Check data-privacy compliance gaps

A data map and gap analysis against GDPR / DPDP / PDPL principles with remediation steps.

This is a practical, copy-paste process for launching a product that collects personal data.. Use it when you want a clear structure, then add your own details and the linked evidence.

Published by Deepstory Research. Reviewed Sep 2026.

How to use this method

  1. 1. Copy or downloadCopy the prompt below, or download the method file and attach it to your chat.
  2. 2. Paste into any AIChatGPT, Claude, Gemini or Copilot. Replace each [PLACEHOLDER] with your details, or let the AI ask you.
  3. 3. Add evidenceAttach the evidence files listed on this page so the AI works from sourced numbers, not guesses.

The prompt

Paste it as-is. The AI will ask for anything still in [BRACKETS].

Download .md
# Check data-privacy compliance gaps
Method by Deepstory Research: deepstoryresearch.com/method/data-privacy-gap-check

You are a privacy programme manager. Follow the method below step by step. Goal: A data map and gap analysis against GDPR / DPDP / PDPL principles with remediation steps.

## My inputs
- Product and data collected: [PRODUCT_AND_DATA_COLLECTED]  (example: mobile app with location and email)
- Jurisdictions: [JURISDICTIONS]  (example: India DPDP, UAE PDPL, EU GDPR)
- Current practices: [CURRENT_PRACTICES]  (example: privacy policy, tools used)

Before you start: if any input above is still in [BRACKETS] or missing, ask me for it in one short numbered list and wait. Do not guess. If I attached files (data, briefs, Deepstory evidence files), treat them as the primary source.

## Steps to follow
1. Map personal data: what, why, where stored, who accesses, retention.
2. Check lawful basis, consent, notices, rights handling, transfers, security.
3. Identify gaps and severity.
4. Write remediation plan.

## Deliver the output in this structure
- Data map
- Gap table
- Remediation plan
- Policy updates needed

## Quality rules
- Not legal advice; list items for counsel.
- Label every number as FACT (with source and date), ESTIMATE (show the calculation) or ASSUMPTION.
- If a Deepstory evidence file is attached, use its figures as the reference values and cite its source references; tag claims that are not from it as [UNVERIFIED].
- End with: the 3 assumptions that matter most, what would change the answer, and the single best next step.

What you need to give the AI

InputPlaceholderExample
Product and data collected[PRODUCT_AND_DATA_COLLECTED]mobile app with location and email
Jurisdictions[JURISDICTIONS]India DPDP, UAE PDPL, EU GDPR
Current practices[CURRENT_PRACTICES]privacy policy, tools used

Use it when

  • Launching a product that collects personal data.
  • Customer security questionnaires.

What you get

  • Data map
  • Gap table
  • Remediation plan
  • Policy updates needed

The procedure, step by step

Read this before you run it, so you can check the AI actually followed the method.

  1. 1

    Map personal data: what, why, where stored, who accesses, retention.

  2. 2

    Check lawful basis, consent, notices, rights handling, transfers, security.

  3. 3

    Identify gaps and severity.

  4. 4

    Write remediation plan.

Quality checks built into the prompt

  • • Not legal advice; list items for counsel.
  • • Every number labelled FACT, ESTIMATE or ASSUMPTION; claims outside attached evidence tagged [UNVERIFIED].

Evidence to use with this method

Methods tell the AI how to think. Evidence gives it sourced numbers to think with. Download a context file and attach it with the prompt.

Run next

Methods that chain well after this one.

Technology & DevelopmentThreat-model an applicationA STRIDE threat model with data flows, threats, risk ratings and mitigations.Legal, Risk & ComplianceReview a contract for risks (first pass)A clause-by-clause first-pass review flagging risky terms, missing protections and questions for your lawyer.Legal, Risk & ComplianceMap the regulations that apply to your businessA map of laws, regulators, licences and upcoming rule changes relevant to a product in a jurisdiction.

Deepstory methods are process guidance for AI tools. Review AI output before relying on it; legal, tax, medical and investment decisions need a qualified professional.