Privacy Policy Gap Checker

About the Privacy Policy Gap Checker

Each privacy law has its own list of what a privacy notice must tell people: Articles 13 and 14 of the GDPR in the EU (and the same articles of the UK GDPR), the privacy-policy rules of the CCPA Regulations in California, and section 5 of India’s DPDP Act with rule 3 of the DPDP Rules. Paste your notice or choose it as a Word file or PDF, tick the laws that apply and answer a few questions about your organisation. The checker goes through every required disclosure — who you are and how to reach you, the purposes and legal bases, the recipients and transfers, how long data is kept, each right, how to complain, selling and sharing, sensitive data, children and the date of the last update — and shows, for each one, the provision that asks for it and the passage it relied on, with the matching words highlighted.

What it cannot find is listed as a gap. Mark the items your notice covers in other words, or that do not apply to you, and the counts follow. The free preview shows every count with the first items of each law; the full list, the PDF gap report and Copy summary need a Premium pass. Your notice is read on your device and never uploaded.

Common uses

• Reviewing your own privacy notice before a launch, an audit or a funding round.
• Checking a vendor’s or a client’s privacy policy against the laws that apply to them.
• Updating a GDPR notice for California or for India’s DPDP Rules.
• Preparing a list of changes for your lawyer to review.

What each law asks a notice to say

• GDPR and UK GDPR, Article 13 (data collected from the person): the controller’s identity and contact details and any representative; the data protection officer’s contact details; the purposes and the legal basis of each; the legitimate interests relied on; the recipients; transfers outside the EEA or the UK with their safeguards; how long data is kept; the rights of access, rectification, erasure, restriction, objection and portability; the right to withdraw consent; the right to complain to a supervisory authority; whether people must give the data and what happens if they do not; automated decision-making. Article 14 (data from other sources) adds the categories of data and where they came from.
• California, CCPA Regulations §7011(e): the categories of personal information collected in the preceding 12 months, their sources and the purposes; what was sold or shared, to whom and why — or that nothing was; whether the business knowingly sells or shares the data of consumers under 16; disclosures for a business purpose; the use of sensitive personal information; the rights to know, delete, correct, opt out, limit and — for automated decisionmaking technology used for significant decisions — to opt out of it and to access it (compliance from 1 January 2027); the right not to be retaliated against; how to make a request, how requests are verified, opt-out preference signals, authorized agents, a contact and the date last updated. Civil Code §1798.100(a)(3) adds how long each category is kept.
• India, DPDP Act section 5 and DPDP Rules rule 3: an itemised description of the personal data, the specified purposes and the goods, services or uses they enable, and how to withdraw consent, exercise the rights and complain to the Data Protection Board — in a notice that can be understood on its own, in clear and plain language, readable in English or a language of the Eighth Schedule (section 5(3)). Section 8(9) and rule 9 add the contact who answers questions; sections 13 and 14 the grievance process and the right to nominate.

How the checker reads a notice

The notice is split into headings and passages. Each item has phrases that show it plainly (“right to object”, “lodge a complaint”, “categories of sources”) and weaker signs: two weak signs in one passage, or one under a heading that fits (“How long we keep it”), make it a Check. A heading alone that fits is a Check too, with the passage under it. The passage relied on is shown with the matching words highlighted, and Show in the notice selects it in the text box, so you can judge each one yourself.

When each law applies

• GDPR: organisations in the EU or the EEA, and organisations elsewhere that offer goods or services to people there or monitor their behaviour (Article 3). The UK GDPR applies in the same way for the UK.
• CCPA: a for-profit business that does business in California and meets one of the thresholds of Civil Code §1798.140(d) — annual gross revenue above $25 million as adjusted for inflation, buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or half or more of its revenue from selling or sharing it.
• DPDP Act: digital personal data processed in India, and processing outside India for offering goods or services to people in India (section 3). The notice of rule 3 applies from 13 May 2027.

Found is not the same as enough

A phrase can be present while the disclosure falls short: a right named without how to use it, one legal basis given for every purpose together, “trusted partners” instead of the categories of recipients, or “as long as necessary” with no criteria for how long. Read each passage the checker relied on against the provision. The ICO’s guidance on the right to be informed has a checklist of what to tell people and when.

Limitations

• Matching phrases and headings is a checklist aid, not a legal review: a disclosure in unusual words can be missed (mark it with It says this), and a passage that is found can still say too little.
• It checks the notice, not your practices: a notice that names every item but describes your processing wrongly is still a problem.
• English-language notices only. Scanned PDFs have no text to read: run PDF OCR first, then paste the text.
• Other laws — such as other US state privacy laws, Brazil’s LGPD and sector rules — and separate notices some laws require (California’s notice at collection and opt-out links, cookie banners) are not checked. Not legal advice.

Privacy

Your notice is read and checked in your browser and never uploaded or stored. Only the laws you tick and your answers about the organisation are remembered in this browser.