GDPR/CCPA compliance gap report in a session

Technical founders and CTOs at 5-50 person SaaS companies crossing into EU or California markets, typically at $100K-$2M ARR · Assemble in ~10 min; full gap report in one session (60-90 min with codebase scan).

LegalEdit flowon X● golden 96

Not legal advice. This recipe drafts and reviews documents to save you time — have a licensed attorney review anything you sign, file, or publish.

step 1connector

Capture company data profile

⚡ bring your own tool

step 2ready

Select applicable frameworks and compute control overlap

compliance-os4 alts

step 3ready

Run GDPR Article-cited gap interrogation

gdpr-audit-prep

step 4ready

Scan codebase and data flows for privacy risks

gdpr-dsgvo-expert

step 5ready

Run standing-state compliance audit diff

audit-compliance

step 6ready

Pull CCPA and US state-law statutory references

legal-researcher6 alts

step 7ready

Generate structured gap report and remediation roadmap

gdpr-compliance4 alts

Did this recipe work for you?

What you get

▸Structured gap report: per-regulation table (GDPR, CCPA, applicable US state laws) with gap severity and controlling Article/section citations
▸DPIA documentation skeleton ready for your DPO or outside counsel to complete
▸Prioritized remediation backlog (critical / high / medium) with 90-day action plan
▸Cross-framework control overlap map showing which fixes satisfy multiple regulations simultaneously

tools: No paid tools required — all skills run on Claude Code; codebase access is local

tokens: ~$4-10 per full session depending on codebase size and number of frameworks

≈ Near-zero ongoing cost; re-run quarterly (~$10-30/year at session cost)

What stays yours

· Attorney or privacy counsel review is required before treating the gap report as a compliance determination or making representations to regulators, customers, or investors
· Verify CCPA/state statute references against current official text — state privacy laws are actively amended and training data has a cutoff
· Approve and prioritize the remediation backlog with your engineering lead before scheduling fixes

✓ Last verified 2026-06-11claude-sonnet-4-6 (subagent, test-mode fixtures)

✓ step 1 · Capture company data profile

✓ step 2 · Select applicable frameworks and compute control overlap

✓ step 3 · Run GDPR Article-cited gap interrogation

✓ step 4 · Scan codebase and data flows for privacy risks

✓ step 5 · Run standing-state compliance audit diff

✓ step 6 · Pull CCPA and US state-law statutory references

✓ step 7 · Generate structured gap report and remediation roadmap

view sample outputs from this run

step 2 · Select applicable frameworks and compute control overlap

# Applicable Compliance Frameworks — SnapLedger Inc.

**Generated:** 2026-06-11
**Source:** company-data-profile.md
**Method:** Jurisdiction + data-category + user-count thresholds applied per framework trigger rules

---

## Framework Selection Analysis

### Criteria Applied

1. **Geography of data subjects** — EU/EEA (Germany, Netherlands), UK, US (all states), Canada
2. **Volume thresholds** — 18,000 end-user accounts; 6,500 marketing contacts
3. **Data sensitivity** — financial/transactional data, OAuth tokens, behavioral tracking
4. **Revenue** — $2.1M ARR (relevant for CCPA threshold)
5.…

step 3 · Run GDPR Article-cited gap interrogation

# GDPR Gap Findings — SnapLedger Inc.

**Generated:** 2026-06-11
**Frameworks:** GDPR (EU) 2016/679; UK GDPR (UK DPA 2018)
**Interrogation Method:** Six-question Article-cited forcing framework
**Data Source:** company-data-profile.md; applicable-framework-list.md

---

## Interrogation 1: Lawful Basis (Art. 5(1)(a), Art. 6, Art. 9)

### Question
For every processing activity, what is the documented lawful basis under Art. 6(1), and where special categories (Art. 9) are involved, under Art. 9(2)?

### Current State
- No documented lawful basis per processing activity
- "Legitimate interest" ap…

step 4 · Scan codebase and data flows for privacy risks

# Codebase & Data Flow Privacy Risk Findings — SnapLedger Inc.

**Generated:** 2026-06-11
**Source:** gdpr-gap-findings.md; processor-inventory.md
**Method:** GDPR/DSGVO expert pattern analysis applied to described architecture and data flows
**Note:** Analysis based on described architecture. A live codebase review against actual source code is required to confirm all findings. This document is a risk-surface map, not an audit opinion.

---

## Risk Finding Categories

- **P1 — Critical Privacy Risk:** Immediate remediation required; enforcement or breach exposure
- **P2 — High Privacy Risk:*…

The problem

When I'm scaling my SaaS or app beyond the first few hundred users and entering EU or California markets, I want a structured compliance gap report showing exactly what I'm missing versus GDPR/CCPA requirements, so that I don't pay $5,000-$25,000 for a compliance consultant or risk enforcement action.

Cybernetic layers

Memorybyo

No harvested memory artifact. Persist the company data profile and gap report as a markdown file in your repo — re-run quarterly or after any significant data architecture change. This file is your compliance state-of-record.

Backgroundnot-applicable

This is a batch session job, not a continuous monitor. Re-triggering on a quarterly cron is the right cadence; real-time monitoring of regulatory changes is out of scope for this recipe.

Harnessready

Claude Code is the runtime. Install each skill into ~/.claude/skills/ and invoke in sequence. Skills can be chained in a single session — paste the produces_io of each step as context into the next.

Click any step to see what fills it — and the ranked alternatives you can swap in.