Auditing Our Privacy Policy Against Current GDPR — Found 7 Gaps

# mrchief skill: legal-advisor
# Privacy policy GDPR audit

task: gdpr-privacy-policy-audit
input: ./policies/privacy-policy-current.pdf
jurisdiction: france
standards:
  - GDPR (Regulation 2016/679)
  - CNIL guidelines (current as of scan date)
  - EDPB guidelines (all adopted)
  - CJEU relevant rulings (2018-present)
language: french
output: gap-report-with-fixes
severity_scoring: true

GDPR PRIVACY POLICY AUDIT — PyratzLabs SAS
════════════════════════════════════════════

AUDIT DATE: 2026-03-10
POLICY VERSION: v2.3 (last updated: 2025-06-15)
REGULATION VERSION: GDPR + CNIL guidance through Feb 2026

FINDINGS: 7 GAPS IDENTIFIED
━━━━━━━━━━━━━━━━━━━━━━━━━━━

🔴 CRITICAL (2)
─────────────────
GAP #1: Incomplete legal bases for processing activities
  Section: "Pourquoi traitons-nous vos données"
  Issue: Policy states "legitimate interest" for newsletter
  sending without balancing test documentation reference.
  CNIL Position (2025-09): Legitimate interest for B2C
  marketing requires documented balancing test, accessible
  to data subjects upon request.
  Fix: Add reference to balancing test. Document the test
  separately. Include mention of opt-out mechanism in same
  paragraph.
  GDPR Reference: Art. 6(1)(f), Recital 47

GAP #2: Missing right to lodge complaint with supervisory authority
  Section: "Vos droits"
  Issue: Lists right of access, rectification, erasure,
  portability, restriction, objection. Does NOT mention
  right to lodge complaint with CNIL (Art. 77).
  This is explicitly required by Art. 13(2)(d).
  Fix: Add "Vous disposez également du droit d'introduire
  une réclamation auprès de la CNIL (www.cnil.fr)."
  GDPR Reference: Art. 13(2)(d), Art. 77

⚠️ HIGH (3)
─────────────
GAP #3: Data retention periods too vague
  Section: "Durée de conservation"
  Issue: States "we retain data as long as necessary."
  CNIL requires specific periods per processing purpose.
  Fix: Add table mapping each purpose to specific retention
  period. CNIL reference guide: délibération 2019-160.

GAP #4: International transfers — no mechanism specified
  Section: "Transferts de données"
  Issue: Mentions "some data may be transferred outside EU"
  but doesn't specify transfer mechanism (SCCs, adequacy
  decision, or Art. 49 derogation).
  Post-Schrems II: must specify mechanism + supplementary
  measures if applicable.
  Fix: List each non-EU processor, applicable mechanism,
  and link to relevant SCC version.

GAP #5: Cookie consent mechanism not referenced
  Section: (Missing)
  Issue: No mention of cookie policy or consent mechanism.
  CNIL guidelines on cookies (2020, updated 2024) require
  clear information in privacy policy + separate cookie banner.
  Fix: Add cookie section or clear cross-reference to
  separate cookie policy.

ℹ️ MEDIUM (2)
──────────────
GAP #6: DPO contact incomplete
  Section: "Contact"
  Issue: Lists generic privacy@pyratzlabs.com but Art. 37-39
  requires published DPO contact details if DPO appointed.
  If no DPO appointed: must clarify who handles privacy.
  Fix: Either publish DPO name/contact or clarify privacy
  contact role and authority.

GAP #7: No mention of automated decision-making
  Section: (Missing)
  Issue: Art. 13(2)(f) requires disclosure of automated
  decision-making including profiling, with meaningful
  information about logic, significance, and consequences.
  If no automated decision-making: state this explicitly.
  Fix: Add section — either disclosing ADM practices or
  confirming none exist.

COMPLIANT AREAS (36/43): ✅
━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Controller identity and contact details (Art. 13(1)(a))
✅ Processing purposes clearly stated (Art. 13(1)(c))
✅ Categories of personal data (Art. 14(1)(d))
✅ Recipients/categories of recipients (Art. 13(1)(e))
... [36 total passing checks]

mrchief run legal-advisor \
  --task gdpr-privacy-policy-audit \
  --input ./your-privacy-policy.pdf \
  --jurisdiction france \
  --severity-scoring true