Compare Data Protection Remediation Plan Against Regulatory Undertaking Commitments

Skill: Gap Analysis: Data Protection Remediation Plan vs. Regulatory Undertaking Commitments

1. Subject-matter triage

• Treat the undertaking as the controlling obligation set; do not generalise from abstract privacy principles unless they help interpret the specific commitment wording.
• If the source set includes an investigation summary, use it to identify the regulatory harm, control failure, and expected remediation theme behind each commitment.
• If there are review emails, treat them as evidence of scope clarifications, agreed revisions, unresolved objections, or timing commitments that may affect whether the plan is complete.
• If a mapping matrix exists, use it only as a starting index; verify every linkage independently against the underlying documents.

2. Failure modes the skill is correcting

• Agent gives a generic “overall compliant / non-compliant” view instead of analysing each commitment separately.
• Agent accepts a prebuilt crosswalk without checking whether the cited plan section actually satisfies the commitment’s wording.
• Agent misses gaps in implementation detail: ownership, evidence of completion, testing, reporting, or sequence.
• Agent fails to tie each gap back to the investigation facts, so the remediation appears detached from the original control failure.
• Agent ignores fixed regulatory dates and milestones, leading to a plan that is directionally right but temporally non-compliant.
• Agent identifies a problem but does not close it with a severity judgment, consequence, and concrete next step.

3. Legal frameworks / domain conventions that apply

• A regulatory undertaking is governed by its own wording and any stated statutory or administrative basis; the commitment text is the primary benchmark for sufficiency.
• The underlying data protection obligations matter because the remediation must address the root cause identified by the regulator, not merely a related operational issue.
• Remediation plans in this context ordinarily require:
  • a defined action or control change,
  • an accountable owner,
  • a target date or milestone,
  • implementation evidence,
  • and a verification or testing mechanism.
• A plan is incomplete if it describes an intention but does not specify how completion will be demonstrated.
• Where the undertaking contains phased milestones or reporting obligations, those dates are binding constraints on the remediation plan’s sequence and evidence package.

4. Analytical scaffolds

• First enumerate every commitment in the undertaking as a numbered list, preserving its meaning in concise form.
• Then, for each commitment, identify the most relevant remediation plan section or sections and test four questions:
  • Does the plan address the same obligation, not just a related one?
  • Does it include implementation detail sufficient to show completion?
  • Does it align with the required timing, owner, and evidence standard?
  • Does it provide verification or testing that proves the control works?
• Use the investigation summary to anchor the analysis in the regulator’s factual concern; if the plan remediates a downstream symptom but not the root cause, call that out as a gap.
• If the source set contains a mapping matrix, compare it against your own reading and flag any overbroad or unsupported mappings.
• For each issue, close the analysis with:
  • the commitment and plan section(s),
  • the gap type,
  • the severity,
  • the regulatory or operational consequence,
  • and the recommended fix.
• Where a commitment is only partly met, distinguish between coverage gaps, timing gaps, evidence gaps, and verification gaps rather than collapsing them into one label.
• If a commitment has no meaningful plan counterpart, say so expressly and explain why the plan fails to reach the required subject matter.

5. Vertical / structural / temporal relationships

• Treat the commitment list as the vertical hierarchy: analyse top-level commitments first, then sub-requirements, then any embedded milestones or reporting duties.
• Treat dates in the undertaking as hard external constraints; a later internal plan date is a gap unless the undertaking allows it.
• If implementation depends on a vendor or another function, check whether that dependency is actually captured in the plan with enforceable responsibility and timing.
• If the source documents include sequential steps, verify that the plan respects the order in which controls must be designed, implemented, tested, and reported.
• If the undertaking requires evidence before reporting, do not treat a promise to “complete later” as satisfaction.

6. Output structure conventions

• Produce a gap analysis report organised by commitment, with each commitment receiving a clear pass / partial / fail assessment.
• Open with a short methodology note that states the documents compared and the severity scale used.
• Define a uniform ordinal severity scale once near the top and apply it consistently to every issue entry.
• Include a compact summary table with columns for commitment, plan section, gap type, severity, and recommended action.
• Follow with commitment-by-commitment analysis that identifies the gap, explains why it matters, and states the consequence of leaving it unresolved.
• End with a Recommended Actions section that uses imperative verbs, identifies the responsible role or function from the source set where possible, and ties each action to the relevant regulatory milestone or deadline.
• Use ordinary legal/business prose; do not reproduce internal wording verbatim except where the task specifically asks for it.
• Name the deliverable file exactly as instructed and ensure the report is complete in substance, not just in outline.