reg-gap-analysis

/reg-gap-analysis

Load ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md → personal information processing rule commitments, regulatory coverage scope, DSAR system.
Execute the following workflow.
Scoping: does the regulation apply? (jurisdiction, thresholds, industry)
Extract requirements → compare against current state → gap list.
Remediation plan with owners, dates, priorities.
Save a dated document. Record it even if there is "no gap".

/privacy-legal:reg-gap-analysis "个人信息出境标准合同办法"

/privacy-legal:reg-gap-analysis
[粘贴指引 / 法规文本]

Regulation and processing rules gap analysis

Purpose

The Cyberspace Administration issued new rules. MIIT released new standards. The National Data Administration issued new guidelines. The regulations changed—now you need to know what, if anything, you must change.

This skill compares new requirements against your current actual situation (according to ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md → personal information processing rule commitments + actual practices recorded in the PIA), and produces a gap list with a remediation plan.

Load current state

Read ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md：

## 个人信息处理规则承诺 — what you have publicly committed to
## 监管覆盖范围 — what already applies
## DSAR 流程 → system inventory — what you actually do operationally

If the regulation does not apply to you (wrong jurisdiction, below threshold, different industry), the gap analysis has only one line: "Not applicable. Reason: [reason]. No action required."

Workflow

Step 1: Define the regulation's scope of application

Before the gap comparison, answer:

Does it apply? Jurisdiction (do you have personal information subjects in that jurisdiction?), thresholds (revenue, user count, data volume), industry exceptions
When? Effective date, enforcement start date (usually later than effective date), any phased implementation
What is genuinely new? Many new rules may overlap substantially with your existing compliance. Identify what is incremental relative to what you already comply with, rather than the full text.

Step 2: Extract requirements

Read the regulation (or summary/guidelines). List each substantive requirement as a separate item:

#	Requirement	Citation	Category
1	[original requirement text]	[clause]	[notice / rights / security / vendor / other]

Categories:

Notice — what users must be told (processing rule content)
Rights — what users can request (related to personal information subject rights)
Security — technical/organizational measures
Vendor — what must be flowed down to entrusted processors
Consent — opt-in/opt-out mechanisms
Governance — personal information protection officer, impact assessments, record keeping

Step 3: Compare against current state

For each requirement:

### [要求 #N]：[简短名称]

**法规要求：** [要求，原文引用或转述]

**我们目前：** [配置 CLAUDE.md / 处理规则 / 实践显示的内容]

**差距：** [无 / 部分 / 完全]

**如为部分/完全差距 — 缺失什么：** [具体]

**弥合工作量：** [仅需更新处理规则 / 产品变更 / 供应商重新谈判 / 新流程]

**不合规风险：** [行政处罚幅度、执法可能性、声誉影响]

Step 4: Prioritize

Not every gap is equally important. Rank by:

Hard deadlines with teeth — effective date + active enforcement + actual penalties
Effort-to-impact ratio — updating language on processing rules is cheap; rebuilding a product is not
You have already completed 80% of — if you are already at 80% due to some regime, the incremental delta of the new law may be small

Step 5: Remediation Plan

Prefix with ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md ## 输出 heading for work product within (varies by user role — see ## 谁在使用）。

Retrieval connector pre-check. Before outputting the remediation plan, check whether the legal retrieval connector is accessible. Collect this information into the review notes under CLAUDE.md ## 输出 : if no connector returned results in Step 2 or the common regulatory category retrieval step, record it in the **Source:** line of the review notes — e.g. 未连接——引用来自训练知识；差距分析中最容易造假的是新法规的生效日期、执法开始日期和条号精准引用——优先核对这些. Per-item [模型知识 — 需验证] labels remain inline. Do not emit a separate banner above the output.

[工作成果抬头 — 按插件配置 ## 输出]

## 整改计划：[法规名称]

**生效日期：** [日期]
**执法开始：** [日期]

### 执法前必须完成

| 差距 | 整改措施 | 负责人 | 截止日期 | 状态 |
|---|---|---|---|---|
| [差距] | [具体措施] | [姓名] | [日期] | [ ] |

### 应做（较低风险，非阻塞）

[同上表]

### 已合规

[差距为"无"的要求列表——对"我们基本没问题"的信息有用]

### 已接受的差距（风险已接受，不整改）

[如有——附记录的理由和风险接受人]

Common Regulatory Categories (China Law System)

When defining the delta, classifying the new regulation into the following broad categories helps with orientation, then retrieve the specific content:

Comprehensive personal information protection regulation — broad provisions covering personal information processing practices in a jurisdiction (PIPL level)
Industry-specific regulation — finance, healthcare, minors, education, labor and employment, etc. (e.g. Personal Financial Information Protection Technical Specification, Provisions on the Cyber Protection of Children's Personal Information)
Data outbound transfer regimes — security assessment, standard contract, certification requirements (Measures for Security Assessment of Data Exports, Measures for Standard Contracts for Export of Personal Information)
AI/algorithm-specific regulation — transparency, impact assessment, or algorithmic governance (Measures for the Administration of Generative AI Services, Provisions on the Administration of Algorithmic Recommendations for Internet Information Services, Provisions on the Administration of Deep Synthesis of Internet Information Services)
Data breach notification regimes — notification requirements that are standalone or embedded in broader laws (PIPL Article 57 and related departmental rules)
Data security regimes — the Data Security Law and its supporting provisions (classified and graded data protection, important data catalogues, etc.)

For each category relevant to the new regulation,retrieve the currently effective requirements before drafting the gap analysis. Cite primary sources. Verify currency — new administrative regulations and departmental rules are frequently issued. When uncertain, flag for attorney verification rather than asserting unconfirmed rules.

No silent supplementation. If a retrieval query returns few or zero results, report what was found and stop. Do not fill gaps from web search or model knowledge without asking. Say: "Search returned [N] results. Coverage appears weak. Options: (1) broaden the search query, (2) try a different retrieval tool, (3) search the web — results will be flagged as [联网检索 — 需复核], and should be verified with the issuing authority before relying on them, (4) flag as unverified and stop. Which do you want to choose?" It is for the attorney to decide whether to accept lower-credibility sources.

Source provenance label layering. Mark the source for each citation in the gap analysis. For model knowledge citations:

[已确定] — stable, well-known statutory and administrative regulation citations are unlikely to have changed

[需验证] — the model knowledge citation is genuine but should be verified: specific implementing rules, regulatory guidance, case positions, thresholds, effective dates

[需验证——精准引用] — Precision citation fabrication risk is highest; always verify against the primary source

Citations obtained by retrieval tools retain their source label; web search citations retain [联网检索 — 需复核]; user-provided citations retain [用户提供]. Layering reveals the real verification work. Never strip or collapse labels.

Integration with Other Skills

From PIA generation: PIA flags inconsistencies in personal information processing rules—these are input here as known gaps.

To the regulatory-legal plugin (if installed): This skill is the manual version. The monitor plugin monitors regulatory developments and automatically triggers this analysis when regulations change.

Output

Save as a dated markdown document. The remediation plan table becomes the tracker—update status as project items close.

If the gap analysis concludes "no gaps, compliant," still write the document—later it is useful evidence that you checked.

End with a citation verification reminder:

Citations in this output are generated by an AI model and have not yet been checked against primary sources. Before relying on any regulation, guidance, or enforcement action, verify accuracy and current effect against legal retrieval tools (such as yuandian MCP or the issuing authority's official website). AI-generated citations may be fabricated or misattributed. The source label on each citation (such as [联网检索 — 需复核]) shows its source; labels with 验证 carry higher fabrication risk and should be checked first.

End with the following next-step decision tree

End with a next-step decision tree consistent with CLAUDE.md ## 输出 . Customize the options based on what this skill just produced—the five default branches (draft X, escalate, obtain more facts, observe and wait, other) are a starting point, not a lock-in. The decision tree is the output; the lawyer chooses.

What This Skill Does Not Do

Does not authoritatively interpret ambiguous regulatory language. When a regulation is unclear, say: "Article X can be read as [A] or [B]. [A] is the conservative reading. If materially significant, consult outside counsel."
Does not proactively track regulatory changes. It runs when you specify a change. For proactive monitoring, see the regulatory-legal plugin.
Does not execute remediation measures. It plans them.