Analyze Cpra Compliance Gaps Against Current Privacy Program

Skill: Analyze Privacy Law Compliance Gaps Against Current Privacy Program — Gap Analysis Memorandum

1. Subject-matter triage

• Treat this as a comparison-and-issue-spotting task: reconcile the privacy program documents against the operative CPRA framework, then translate each mismatch into a memo-ready gap finding.
• First inventory the source set and identify the document types in play: privacy notice, data map or processing inventory, vendor terms, consumer request procedures, security materials, risk assessment materials, and any governance artifacts that bear on disclosures or control design.
• If the source set contains only one privacy artifact, say so and analyze it as a standalone statement; otherwise compare the documents against one another before assessing CPRA compliance.

2. Failure modes the skill is correcting

• The analysis stays at the level of policy language and does not reconcile stated categories, purposes, recipients, retention concepts, and controls against the actual processing inventory.
• Third-party disclosures are treated generically, so the analysis misses when analytics, advertising, or similar disclosures may be sale/sharing or otherwise trigger opt-out and contract analysis.
• Sensitive personal information obligations are collapsed into ordinary privacy disclosure review, causing omission of the separate limitation right and related notice mechanics.
• Vendor review is skipped or underweighted, so the analysis fails to test whether written terms actually implement the required processing restrictions, downstream controls, and permitted-use limitations.
• Consumer request handling is described abstractly without testing intake, verification, timing, response, correction, deletion, and downstream fulfillment steps against the governing rules.
• Security and risk-assessment issues are treated as background rather than operational compliance gaps with distinct remediation paths.
• Findings are stated without clear severity, making prioritization and remediation sequencing unreliable.
• Recommendations are generic, untethered to a responsible role or near-term remediation plan.

3. Legal frameworks / domain conventions that apply

• Consumer rights under the CPRA framework include notice, access/know, correction, deletion, portability, opt out of sale or sharing, limit use and disclosure of sensitive personal information, and non-discrimination; anchor propositions to the CPRA and its implementing regulations.
• Disclosures of personal information must be classified by function, not label: sale, sharing, service-provider disclosure, contractor disclosure, or another permitted transfer category.
• Sensitive personal information must be identified and assessed separately for notice, limitation-right, and operational controls.
• Service provider and contractor arrangements must be tested against the statutory and regulatory contract requirements, including use limits, purpose limits, flow-down controls, and subcontracting constraints.
• Consumer request mechanics must be evaluated against the CPRA regulations governing intake, verification, timing, extension handling, and downstream implementation.
• Data security should be reviewed against the program’s stated controls and any applicable statutory or regulatory baseline, including whether the program matches the actual data environment.
• Risk assessment obligations should be checked where the processing presents heightened risk or where the source materials indicate assessment triggers, documentation, or approval workflows.
• Privacy notices and internal inventories must align with actual data practices; aspirational descriptions are not a substitute for disclosed operations.
• Cite the controlling authority for each proposition relied on, using the statute, regulation, or recognized authority that supports the point.

4. Analytical scaffolds

• Start with a full issue inventory: list each distinct processing activity, disclosure pathway, consumer right workflow, vendor relationship, sensitive-data category, and governance control that appears in the source set.
• For each item, compare: stated description in the notice or policy; actual description in the inventory or operational materials; contractual implementation in vendor terms; and any supporting procedure or control.
• For each disclosure pathway, determine the correct CPRA classification and then test whether the notice, opt-out logic, and contract terms match that classification.
• For each consumer right, test whether the program actually enables the right from intake through completion, including required disclosures, identity verification, deadlines, and downstream propagation to vendors or internal systems.
• For each sensitive-data category, test whether the notice, limitation-right mechanism, and operational handling are consistent with the data’s actual use.
• For each vendor or third-party arrangement, test whether the written terms and operating practice align with the intended role of the counterparty.
• For each identified gap, include the legal requirement, current state, required state, severity, and a concrete remediation step.
• Where the source documents supply dates, volumes, or operational scope, use them to calibrate materiality and timing; otherwise state the absence of quantified support and avoid inventing one.

5. Vertical / structural / temporal relationships

• Prioritize gaps that cascade across documents: a misclassified disclosure can affect the notice, opt-out mechanism, vendor terms, and downstream processing at once.
• Treat the privacy notice as a top-layer artifact, but validate it against the underlying inventory and agreements before assigning confidence.
• Sequence remediation by dependency: classify data flows first, align disclosures and notices second, then fix vendor terms and request workflows, and only then finalize monitoring, training, and audit documentation.
• If a control depends on another document being revised first, note that dependency explicitly in the roadmap.
• When the source set reflects multiple business lines, periods, or programs, keep the analysis segmented rather than averaging their compliance posture into a single conclusion.

6. Output structure conventions

• Use a memo format with: executive summary; methodology or scope; findings organized by compliance category; and a prioritized remediation roadmap.
• Define an ordinal severity scale once at the top and apply it uniformly to every finding.
• For each finding, use a compact legal-analysis row or paragraph containing: issue title; controlling authority; current state; required state; severity; downstream consequence; and specific remediation.
• Make each finding operational, not abstract: explain how the gap manifests in the current program and what it changes for the business, the regulator, or consumer requests.
• Include a concise prioritized roadmap that sequences near-term, mid-term, and longer-term remediation actions.
• End with a Recommended Actions block that uses imperative verbs, names the responsible role or function, and gives a timing anchor tied to a regulatory or operational milestone.
• The deliverable filename should be cpra-gap-analysis-memo.docx.