/reg-gap-analysis

1. Load ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md → privacy policy commitments, regulatory footprint, DSAR systems.
2. Run the workflow below.
3. Scope: does the regulation apply? (jurisdiction, thresholds, sector)
4. Extract requirements → diff against current state → gap list.
5. Remediation plan with owners, dates, prioritization.
6. Save dated doc. Even "no gaps" gets documented.

/privacy-legal:reg-gap-analysis "Colorado Privacy Act"

/privacy-legal:reg-gap-analysis
[paste guidance / reg text]

Regulation-to-Policy Gap Analysis

Purpose

A state passes a new privacy law. The ICO issues new guidance. The CPPA finalizes regulations. Something moves — and now you need to know what, if anything, you have to change.

This skill diffs the new requirement against what you currently do (per ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md → Privacy policy commitments + the practices documented in PIAs) and produces a gap list with a remediation plan.

Load current state

Read ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md:

• ## Privacy policy commitments — what you've publicly promised
• ## Regulatory footprint — what already applies
• ## DSAR process → systems list — what you actually do operationally

If the regulation doesn't apply to you (wrong jurisdiction, below threshold, different sector), the gap analysis is one line: "Doesn't apply. Here's why: [reason]. No action needed."

Workflow

Step 1: Scope the regulation

Before diffing, answer:

• Does it apply? Jurisdiction (do you have data subjects there?), threshold (revenue, user count, data volume), sector carve-outs
• When? Effective date, enforcement date (often later), any phase-in
• What's actually new? Many "new" state privacy laws are 90% CCPA with tweaks. Identify the delta from what you already comply with, not the full text.

Step 2: Extract requirements

Read the regulation (or summary/guidance). List every substantive requirement as a discrete item:

Categories:

• Notice — what you have to tell users (privacy policy content)
• Rights — what users can ask for (DSAR-adjacent)
• Security — technical/organizational measures
• Vendor — what you have to flow down to processors
• Consent — opt-in/opt-out mechanics
• Governance — DPO, impact assessments, record-keeping

Step 3: Diff against current state

For each requirement:

### [Requirement #N]: [short name]

**Regulation says:** [requirement, quoted or paraphrased]

**We currently:** [what the config CLAUDE.md / privacy policy / practice shows]

**Gap:** [None | Partial | Full]

**If partial/full gap — what's missing:** [specific]

**Effort to close:** [Policy update only | Product change | Vendor renegotiation |
New process]

**Risk of non-compliance:** [regulatory penalty range, enforcement likelihood,
reputational]

Step 4: Prioritize

Not every gap is equal. Sort by:

1. Hard deadline with teeth — effective date + active enforcement + real penalties
2. Effort-to-impact ratio — policy language update is cheap; product rebuild is not
3. What you've already half-done — if you're 80% there for GDPR, the state law delta may be small

Step 5: Remediation plan

Prepend the work-product header from ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md ## Outputs (it differs by user role — see ## Who's using this).

…