What is a GDPR gap analysis? Irish business guide
Last updated 27 October 2026. General information only, not legal advice.
A GDPR gap analysis is a structured comparison of what your organisation actually does with personal data against what the GDPR and the Data Protection Act 2018 require. It produces a list of gaps, ranked by risk, with actions to close them. It is not a legal requirement by name, but it is a practical way to show you are taking accountability seriously.
What does a GDPR gap analysis involve?
The gap analysis looks at your current practice, not just your paperwork. A typical review covers the following areas:
- What personal data you hold, where it comes from and who it is shared with (data mapping and records of processing; see our GDPR audit guide).
- Lawful basis for each activity, and how consent is handled where you rely on it.
- Privacy notices and whether they match what you really do.
- How you handle data subject requests, such as access requests, within the one-month period in Article 12(3).
- Security measures, breach readiness and the 72-hour notification duty in Article 33.
- Contracts with processors (Article 28) and any transfers outside the EEA.
- Governance: who is responsible, whether a Data Protection Officer is required, and when a DPIA is needed.
Each gap is then rated, for example by the risk it poses to individuals and to the business, so you know what to fix first.
Why do Irish businesses carry one out?
Under Article 5(2), the controller is responsible for, and must be able to demonstrate, compliance. The Data Protection Commission (DPC) says organisations, not regulators, must demonstrate that they comply. A written gap analysis with a dated action plan gives you evidence of what you assessed and what you decided to do.
It is also useful before a major change, when a customer or procurement exercise asks about your data protection practices, or when you have never reviewed your position since GDPR began to apply in 2018. Weaknesses can also affect the level of any penalty if something goes wrong; see our guide to GDPR fines and the DPC. If you are starting from scratch, our GDPR guide for small businesses is a good first read.
How is it different from an audit or a DPIA?
A gap analysis and a GDPR audit overlap, and some providers use the terms as synonyms. In general, a gap analysis compares practice with the requirements, while an audit may also test whether controls work. A DPIA is different: it is a risk assessment of one specific, high-risk processing activity under Article 35. Many organisations start with a gap analysis and then run DPIAs where it flags high-risk processing.
What should you have at the end?
You should have a written report that identifies each gap, explains why it matters, ranks it, and names an owner and a target date. A report that only says “compliant” or “non-compliant” is of limited use. Be wary of any claim that a review can make you fully compliant: compliance is ongoing and depends on what you do afterwards.
Need help with this? Plus Promotions Limited provides GDPR audit and gap analysis for Irish businesses, from €495. The final price is agreed in writing before work begins.
Frequently asked questions
What is the difference between a GDPR gap analysis and a GDPR audit?
The terms overlap and are often used interchangeably. A gap analysis focuses on comparing your current practice with the GDPR and Data Protection Act 2018 and listing what is missing. An audit can go further and test whether documented controls work in practice. Always check what a provider’s deliverable actually includes.
How often should a business carry out a GDPR gap analysis?
The GDPR does not set a fixed frequency. Article 24 requires measures to be reviewed and updated where necessary, and Article 32(1)(d) refers to regularly testing security measures. Many organisations review annually or after a major change such as a new system, supplier or business activity.
Is a GDPR gap analysis mandatory in Ireland?
No. The GDPR does not use the term or require one by name. It does require you to be able to demonstrate compliance (Article 5(2)), and a gap analysis is one practical way to assess where you stand.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
