# Analyze Cpra Compliance Gaps Against Current Privacy Program > Gap analyses can fail when the agent treats privacy disclosures in isolation, misclassifies third-party data disclosures, omits sensitive-data limitation rights, or fails to reconcile policy statements against the actual processing inventory and vendor arrangements. - Skill: `finchipaiorg/analyze-cpra-compliance-gaps-against-current-privacy-program` (Agent Skill) - Install (CLI): `npx skillmds@latest add finchipaiorg/analyze-cpra-compliance-gaps-against-current-privacy-program` - Raw SKILL.md: https://api.skillmd.com/api/skills/finchipaiorg/analyze-cpra-compliance-gaps-against-current-privacy-program/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: FinchipAIOrg (https://skillmd.com/u/finchipaiorg) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/finchipaiorg/analyze-cpra-compliance-gaps-against-current-privacy-program --- # Skill: Analyze Privacy Law Compliance Gaps Against Current Privacy Program — Gap Analysis Memorandum ## 1. Subject-matter triage - Treat this as a comparison-and-issue-spotting task: reconcile the privacy program documents against the operative CPRA framework, then translate each mismatch into a memo-ready gap finding. - First inventory the source set and identify the document types in play: privacy notice, data map or processing inventory, vendor terms, consumer request procedures, security materials, risk assessment materials, and any governance artifacts that bear on disclosures or control design. - If the source set contains only one privacy artifact, say so and analyze it as a standalone statement; otherwise compare the documents against one another before assessing CPRA compliance. ## 2. Failure modes the skill is correcting - The analysis stays at the level of policy language and does not reconcile stated categories, purposes, recipients, retention concepts, and controls against the actual processing inventory. - Third-party disclosures are treated generically, so the analysis misses when analytics, advertising, or similar disclosures may be sale/sharing or otherwise trigger opt-out and contract analysis. - Sensitive personal information obligations are collapsed into ordinary privacy disclosure review, causing omission of the separate limitation right and related notice mechanics. - Vendor review is skipped or underweighted, so the analysis fails to test whether written terms actually implement the required processing restrictions, downstream controls, and permitted-use limitations. - Consumer request handling is described abstractly without testing intake, verification, timing, response, correction, deletion, and downstream fulfillment steps against the governing rules. - Security and risk-assessment issues are treated as background rather than operational compliance gaps with distinct remediation paths. - Findings are stated without clear severity, making prioritization and remediation sequencing unreliable. - Recommendations are generic, untethered to a responsible role or near-term remediation plan. ## 3. Legal frameworks / domain conventions that apply - Consumer rights under the CPRA framework include notice, access/know, correction, deletion, portability, opt out of sale or sharing, limit use and disclosure of sensitive personal information, and non-discrimination; anchor propositions to the CPRA and its implementing regulations. - Disclosures of personal information must be classified by function, not label: sale, sharing, service-provider disclosure, contractor disclosure, or another permitted transfer category. - Sensitive personal information must be identified and assessed separately for notice, limitation-right, and operational controls. - Service provider and contractor arrangements must be tested against the statutory and regulatory contract requirements, including use limits, purpose limits, flow-down controls, and subcontracting constraints. - Consumer request mechanics must be evaluated against the CPRA regulations governing intake, verification, timing, extension handling, and downstream implementation. - Data security should be reviewed against the program’s stated controls and any applicable statutory or regulatory baseline, including whether the program matches the actual data environment. - Risk assessment obligations should be checked where the processing presents heightened risk or where the source materials indicate assessment triggers, documentation, or approval workflows. - Privacy notices and internal inventories must align with actual data practices; aspirational descriptions are not a substitute for disclosed operations. - Cite the controlling authority for each proposition relied on, using the statute, regulation, or recognized authority that supports the point. ## 4. Analytical scaffolds - Start with a full issue inventory: list each distinct processing activity, disclosure pathway, consumer right workflow, vendor relationship, sensitive-data category, and governance control that appears in the source set. - For each item, compare: stated description in the notice or policy; actual description in the inventory or operational materials; contractual implementation in vendor terms; and any supporting procedure or control. - For each disclosure pathway, determine the correct CPRA classification and then test whether the notice, opt-out logic, and contract terms match that classification. - For each consumer right, test whether the program actually enables the right from intake through completion, including required disclosures, identity verification, deadlines, and downstream propagation to vendors or internal systems. - For each sensitive-data category, test whether the notice, limitation-right mechanism, and operational handling are consistent with the data’s actual use. - For each vendor or third-party arrangement, test whether the written terms and operating practice align with the intended role of the counterparty. - For each identified gap, include the legal requirement, current state, required state, severity, and a concrete remediation step. - Where the source documents supply dates, volumes, or operational scope, use them to calibrate materiality and timing; otherwise state the absence of quantified support and avoid inventing one. ## 5. Vertical / structural / temporal relationships - Prioritize gaps that cascade across documents: a misclassified disclosure can affect the notice, opt-out mechanism, vendor terms, and downstream processing at once. - Treat the privacy notice as a top-layer artifact, but validate it against the underlying inventory and agreements before assigning confidence. - Sequence remediation by dependency: classify data flows first, align disclosures and notices second, then fix vendor terms and request workflows, and only then finalize monitoring, training, and audit documentation. - If a control depends on another document being revised first, note that dependency explicitly in the roadmap. - When the source set reflects multiple business lines, periods, or programs, keep the analysis segmented rather than averaging their compliance posture into a single conclusion. ## 6. Output structure conventions - Use a memo format with: executive summary; methodology or scope; findings organized by compliance category; and a prioritized remediation roadmap. - Define an ordinal severity scale once at the top and apply it uniformly to every finding. - For each finding, use a compact legal-analysis row or paragraph containing: issue title; controlling authority; current state; required state; severity; downstream consequence; and specific remediation. - Make each finding operational, not abstract: explain how the gap manifests in the current program and what it changes for the business, the regulator, or consumer requests. - Include a concise prioritized roadmap that sequences near-term, mid-term, and longer-term remediation actions. - End with a Recommended Actions block that uses imperative verbs, names the responsible role or function, and gives a timing anchor tied to a regulatory or operational milestone. - The deliverable filename should be `cpra-gap-analysis-memo.docx`.