Gap review and remediation plan: what the decision maker looks at
A gap review compares what your organisation actually does with personal data against what a written policy says it does. The decision maker — usually a director or the person holding the data protection mandate — looks at three things: how wide the gap is, whether it touches a live processing activity, and how fast the fix can be documented. The remediation plan is approved only when those three answers exist in writing.
What changes once the gap is confirmed
Confirming a gap is not a formality. From that point, the organisation is on record as aware of a shortfall. Any incident that touches the same process afterwards is read against that awareness. This is why the review stage and the remediation stage are treated as two separate decisions, each with its own sign-off, rather than one continuous task delegated to a single team.
The practical effect is timing. A remediation plan without a start date and a named owner is not a plan a decision maker can approve — it is a list of intentions. Reviewers who bring an undated list back for a second round lose the week they were trying to save.
Stages, output and typical duration
| Stage | What it produces | Typical duration |
|---|---|---|
| Scoping | List of processing activities and systems in scope | 2–5 working days |
| Gap mapping | Table of current practice vs required practice, with gap severity | 1–3 weeks |
| Remediation plan | Owner, action, deadline for each gap | 3–7 working days after mapping |
| Sign-off | Approval record with date and decision maker's name | 1–2 working days |
| Follow-up review | Confirmation that closed items stayed closed | Set at sign-off, usually 60–90 days later |
What to do
- The data protection lead lists every processing activity that touches personal data, not only the ones flagged in a prior audit.
- The same lead maps each activity against the organisation's own policy, marking gaps by severity rather than by how easy they are to fix.
- The decision maker reviews the severity table before any remediation drafting starts — sequencing matters more than speed here.
- An owner is named for each gap. A gap without a named owner is not counted as remediated, whatever the status field says.
- The remediation plan is signed with a date, not left as a draft circulated by email.
- A follow-up review date is set at the same meeting as the sign-off, not scheduled later.
Who decides
The decision maker is the person who holds the data protection mandate inside the organisation — often a director, sometimes a designated officer. That person, not the reviewing team, signs the remediation plan. Where the gap touches a system shared with a group entity, the sign-off is joint, and the plan records both signatures. Where a supplier or subprocessor is inside the gap, the decision maker also confirms who notifies that party and by when.
If the organisation has recently changed hands or restructured — the kind of change that also triggers a review of contract standing, as covered in Novation on a corporate change: stages and deadlines — the decision maker confirms who inherits the mandate before the remediation plan is signed. A plan signed by someone who no longer holds the mandate has to be re-signed.
Forks
If the gap review surfaces a shortfall that already caused a near-miss incident, the remediation plan is not enough on its own — the organisation also needs the separate notification track described in How incident notification procedure data protection what the decision maker follows.
If the processing activity in scope involves a joint arrangement with another party — a shared platform, a co-owned dataset — the gap review has to account for how rights and obligations would split if that arrangement ended, the way they do in How exit from a joint venture IP licence runs.
If a dispute over the same processing activity is already running in another country, the timing of your remediation plan has to account for which forum rules first — the logic is the same one set out in When a court in another country decides first: the deadline that matters shifts accordingly.
If the organisation also runs a token or digital-asset product, the remediation plan should be checked against the holder-facing communication track, since a gap notice and a holder notice can land on the same recipients within days of each other — see Holder communication procedure token issuance what the decision maker looks at.
Provenance: what the file needs to show
A gap review file is judged on traceability, not on length. Each entry in the gap table needs a source — where the fact about current practice came from, and who confirmed it. A remediation plan with no traceable source behind its gap entries is weaker evidence of diligence than a short plan with three well-sourced entries.
Keep the chain visible: the person who identified the gap, the person who confirmed it, the person who signed the plan. If any of those three roles is unclear in the file, add a line naming who held it, even retrospectively. A decision maker reviewing the file six months later should be able to follow that chain without asking anyone.
Limit
This page describes the review and sign-off sequence. It does not set out what a specific gap costs to fix, how many systems typically fall inside scope, or what a remediation programme is priced at — that assessment depends on the organisation's own systems and is not something a general procedure page can state. It also does not cover the separate notification duty that applies once a gap has already caused an incident; that sits in the linked incident procedure.
Related publications
Related reading: When personal data flows to a new subprocessor in a live remediation plan is one of the more common triggers we see for reopening a closed gap.
Verified
Page reviewed on the date of publication. The sequence above reflects standard internal escalation practice for gap review files and does not rely on a specific external legal citation; where a specific notification duty or statutory deadline applies to your case, that sits outside this procedural page and should be checked separately.
FAQ
How long does gap review and remediation plan take in practice?
Scoping and mapping typically take two to four weeks combined. The remediation plan itself is usually drafted within a week of the mapping being signed off, provided owners are named without delay. A follow-up review is normally set sixty to ninety days after sign-off.
Which documents are needed to start?
A current list of processing activities, the organisation's existing data protection policy, and a record of who holds the data protection mandate. Without the third item, the review can proceed but the final sign-off will stall.
What happens if the other side does not respond?
Where a gap involves a supplier or subprocessor who does not confirm remediation steps on their side, the decision maker records the outstanding request with a date and escalates through the contract's own notice provisions rather than treating the gap as closed.
Talk to a partner directly for a first response within minutes during business hours, and a scoped quote within one business day. See Data, security and AI obligations and who decides the next step for your file.