GDPR Gap Analysis
A 12-question diagnostic that benchmarks your current practices against GDPR requirements and generates a gap analysis report with remediation priorities.
Tool details
About this tool
A 12-question diagnostic that benchmarks your current programme against GDPR's accountability requirements — Article 30 RoPA, Article 32 security, DPIAs under Article 35, breach notification under Articles 33 and 34, and the Chapter III rights.
What you'll get
- A gap analysis across the eight accountability pillars.
- A prioritised remediation list with the GDPR Article each gap breaches.
- A short pitch for the TruePrivacy workflow that automates each pillar.
How it works
- Twelve questions, each scored one point.
- Score banded into three tiers: Robust (≥ 70%), Developing (40–69%), At-risk (< 40%).
- No data persisted — the quiz state lives only in your browser tab.
Based on
- Regulation (EU) 2016/679 (the GDPR).
- EDPB guidelines on DPIAs, breach notification and SCCs.
- Supervisory authority public enforcement notices.
Do you have a documented lawful basis for each data processing activity?
Article 6 GDPR requires one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) for every processing activity.
Frequently asked questions
Does the gap analysis cover the EU AI Act?+
No — the EU AI Act is a separate regime with its own risk classification. Use /tools/ai-risk-assessor for that.
What's the difference between a DPIA and a legitimate-interests balancing test?+
A DPIA is required when processing is likely to result in high risk (Article 35). A legitimate-interests test is required whenever you rely on Article 6(1)(f) as the lawful basis. The two often overlap but neither replaces the other.
Do I need SCCs if the recipient is in a UK-adequate country?+
If the UK has issued an adequacy regulation for the destination, you don't need SCCs for that transfer. UK adequacy decisions are more generous than the EU's; the EU adequacy list is the stricter one to design to.
How recent is the question set?+
The questions reflect the EDPB guidelines current at the last site build. SCC question wording tracks the 2021 modular clauses + the UK's International Data Transfer Agreement.
Other tools you might find useful
Need more than a free tool?
TruePrivacy is a full privacy operations platform. Automate DSRs, consent, vendor risk, and breach response.
Free 14-day trial · No credit card required · Setup in minutes