Gap review and remediation plan: documents to prepare
A gap review checks what your organisation actually does against what its data protection and security obligations require, then turns the difference into a remediation plan with owners and deadlines. Preparation starts with an accurate register of processing, current policies, and any prior audit findings. Without those three, the review restarts from zero and loses a full working day.
What the gap review establishes
The review does not draft new policy. It compares existing documents against the obligations that apply to your processing, your sector, and your role as controller or processor. The output is a list of gaps, ranked by exposure, and a remediation plan that assigns each gap to a named owner with a date. A gap review triggered by a corporate transaction follows a slightly different document trail than a routine one; where the trigger is a partner leaving a joint structure, the decision points overlap with Exit from a joint venture.
Two reviews rarely start from the same baseline. A company that has never mapped its processing activities needs a data inventory before anything else. A company that already holds one needs only to test whether it still matches reality.
Documents to prepare
Six document types recur across almost every gap review. The table below sets out what each one contributes and who typically holds it inside the organisation.
| Stage | Document | Held by |
|---|---|---|
| Baseline | Register of processing activities | Data protection lead |
| Baseline | Current data protection and security policies | Legal or compliance |
| Baseline | List of vendors and sub-processors with contracts | Procurement |
| Assessment | Prior audit or incident reports | IT or security lead |
| Assessment | Access control and retention records | IT operations |
| Remediation | Draft remediation plan with owners and dates | Steering committee |
Where the plan follows a vendor questionnaire flagging a certification gap, the starting document set is narrower: the questionnaire itself, the certification scope it references, and the internal control that answered it. Where the review touches a technology contract that is about to change hands, the document set widens to include the assignment terms; that scenario is described separately in How novation on a corporate change technology contract what.
How the review runs, step by step
- The data protection lead assembles the baseline documents and confirms the register of processing is current.
- The reviewer compares each processing activity against the applicable obligations and records every gap found.
- The steering committee ranks the gaps by exposure, not by ease of fixing them.
- An owner and a deadline are assigned to each gap in writing.
- The remediation plan is circulated for sign-off before any technical change begins.
- A follow-up review confirms each item was closed, not merely started.
Steps four and five are where most reviews stall. A gap without a named owner does not get fixed; it gets carried into the next review unchanged.
Who decides and how long it takes
Sign-off sits with the body that owns risk appetite for the organisation, usually the board or a delegated risk committee, not with the person who ran the review. The reviewer's role ends at the ranked list of gaps; deciding which gaps to fix first, and by when, is a governance decision. In practice, the baseline stage runs one to two weeks for an organisation with an existing inventory, longer where one has to be built from scratch. The remediation stage runs on the deadlines the committee sets, not on a fixed calendar.
Where the same restructuring also changes who holds the data of end users rather than internal records, the communication obligation runs on a separate track: see Holder communication procedure: documents to prepare for the document list that applies there.
If your situation is different
If the organisation has no prior register of processing, the baseline stage becomes the longest part of the exercise, and the remediation plan cannot start until it closes.
If a joint development partner already acted without waiting for a response from your side, the review needs to account for a fact pattern that is no longer fully within your control; see When the other side moved first in this situation.
If the gap review is a condition of a pending deal rather than routine housekeeping, the deadline is set by the transaction timetable, not by internal governance, and the document set narrows to what the counterparty specifically requested.
What this page does not cover
This page describes the procedure and the document set. It does not set out which specific obligations apply to a given type of processing, and it does not name the article or regulation that creates any particular duty — that assessment depends on facts this page cannot see. It also does not cover the notification procedure that follows a confirmed incident, which is a separate document set entirely.
Related reading
A related checklist covers the stage that follows a confirmed breach, rather than a planned review: How incident notification procedure data protection documents to prepare.
Verified
This procedure was last reviewed in November 2025. It reflects internal file practice rather than a single named source, and it does not rely on any statutory reference that requires separate verification.
FAQ
How long does gap review and remediation plan take in practice?
The baseline stage usually takes one to two weeks where a register of processing already exists, longer where it does not. The remediation stage runs on deadlines the steering committee sets for each gap, so the total length depends on how many gaps carry real exposure.
Which documents are needed to start?
Three documents are enough to begin: the current register of processing activities, existing data protection and security policies, and a list of vendors with their contracts. Prior audit or incident reports speed up the assessment stage but are not required to open it.
What happens if the other side does not respond?
Where the gap review depends on input from a vendor or a counterparty, an unanswered request does not stop the internal timetable. The committee proceeds on the information it holds, flags the outstanding item as an open gap in its own right, and sets a deadline for escalation if the response still does not arrive.
If a vendor questionnaire already raised a certification gap that this review needs to close, What to do first in this situation sets out the first move.