Data privacy compliance gap analysis