Gap review and remediation plan: stages and deadlines
A gap review compares what your organisation currently does against the data protection, security and AI obligations that apply to it, then turns every difference into a remediation task with an owner and a deadline. The review itself usually takes one to three weeks. The remediation plan that follows can run for months, depending on how many systems, vendors and jurisdictions sit inside the scope you set.
What changes once the review is opened
Once a review is opened, every finding needs a status and a due date. A finding without an owner is not a finding; it is a note that will not survive a later audit. The moment the first remediation item is assigned, its clock starts, and a delay on one item can push the whole plan past its target date, because later items often depend on earlier ones being closed first.
The review does not itself trigger a notification to a regulator or to a counterparty. It creates the internal record that shows whether a notification is required later, and how quickly the organisation can produce it if so. Treat the review record and any incident timeline as two separate clocks, even when they start from the same discovery.
What to do
- Appoint an internal owner before the first meeting — usually the data protection lead or the CISO.
- Fix the scope in writing: list systems, data flows, vendors and jurisdictions included, and note what is deliberately excluded.
- Run the fieldwork against a fixed checklist, not against memory. Record every finding, including minor ones.
- Assign each finding an owner, a priority and a deadline before the fieldwork session closes, not afterwards.
- Route the draft plan to management for sign-off with a budget line attached, not as an information item.
- Track closure weekly. Escalate any item that slips two weeks past its deadline to the body that approved the plan.
Who decides and by when
| Stage | What happens | Typical duration | Sign-off |
|---|---|---|---|
| Scoping | Systems, vendors and jurisdictions in scope are fixed in writing | 2–5 days | Data protection lead / CISO |
| Fieldwork | Current controls are checked against required controls; every gap is logged | 1–3 weeks | Reviewer team |
| Draft plan | Each open item gets an owner, a priority and a deadline | 3–5 days | Compliance lead drafts, management reviews |
| Plan sign-off | Management approves the plan and the budget behind it | One steering cycle | Senior management / board |
| Execution and tracking | Owners close items; the tracker is updated weekly | Varies by item | Item owners, reviewed by compliance lead |
| Closure review | Every item is confirmed closed or formally accepted as residual risk | 1–2 weeks after the last item | Same body that signed off the plan |
If the gap points somewhere else
Not every finding is purely technical. Some point to a contract, a licence or a communication obligation that sits outside the review itself.
If the gap traces back to a licence rather than to a technical control, remediation can stall unless the licence itself is fixed first. That is a different clock: see When field-of-use limits are ignored: the deadline that matters.
If a distributor of the affected product is already facing a claim, the remediation plan and the dispute run on separate tracks. When a distributor is sued over your product: the deadline that matters there does not extend the remediation deadline here.
If the gap was found because an integration partner leaked credentials, keep the two procedures separate. When an integration partner leaks credentials: the deadline that matters for notification is usually shorter than the deadline for closing the remediation item itself.
If the system under review supports a tokenised product, remediation may require telling holders what changed and why. The steps are covered separately: Holder communication procedure step by step in practice.
What this page does not cover
This page describes how the review and the remediation plan are run. It does not determine whether a specific data flow or a specific system falls under a given obligation, and it does not set out the wording or content of a notification to a regulator or to a counterparty. Those questions are answered elsewhere, once the scope of the gap is settled.
Related reading
- Incident notification procedure — for when a finding turns out to be an active incident rather than a historic gap.
Next step
A remediation plan and a commercial dispute over service levels can run in parallel without conflicting, provided the deadlines on each are tracked separately from the start. See When an SLA credit regime is triggered in practice for how that separation is kept in practice.
Verified
Verified: 18 September 2025. This procedure has been checked against our internal review methodology and against publicly available regulatory guidance current as of the date above. It does not rely on any single named act and is reviewed whenever internal practice changes.
FAQ
How long does gap review and remediation plan take in practice?
The review itself usually takes one to three weeks, depending on scope. The remediation plan that follows can run for two to six months, because later items often wait on earlier ones being closed first.
Which documents are needed to start?
A current data inventory, a list of vendors and integration partners in scope, prior audit or review findings if any exist, and a named owner for each system under review.
What happens if the other side does not respond?
If a vendor or processor does not respond to a remediation request within the deadline you set, record the non-response and escalate to the relationship owner. Treat the item as open and high-risk until it is actually closed; do not mark it as remediated on the strength of silence.