Data Protection Risk Analysis: Structure, Process, and Practical Examples

What is a risk analysis under the GDPR?

A GDPR risk analysis is used to determine whether, and to what extent, the processing of personal data risks to the rights and freedoms of data subjects may entail. Based on this, companies can evaluate whether a Data Protection Impact Assessment (DPIA) is required and when processing should be classified as high-risk.

Key features of a GDPR data protection risk analysis

When assessing risks, a data protection risk analysis, much like a conventional risk analysis, relies primarily on two cornerstones: the likelihood of occurrence and the severity of the harm.  

Using these criteria, companies must systematically identify, assess, and document any potential risks. The key distinction here is that the assessor must adopt the perspective of the data subject.

What constitutes a data protection risk under the GDPR?

Although the GDPR follows a risk-based approach, it does not explicitly define what constitutes a data protection risk. Recital 75 of the GDPR lists various data protection risks from the perspective of the data subject, though these leave significant room for interpretation. These data protection risks relate to personal data and include, among others:

• Discrimination
• Identity theft or fraud
• Financial loss
• Reputational damage
• Other significant economic or social disadvantages

Procedures for secure data protection risk management in the company

There are various data protection levelsthat you must consider in GDPR risk management. To weigh how risky a situation is—and therefore the probability of occurrence—and whether a DPIA is required, those responsible should review the following and evaluate the individual points using, for example, "low," "medium," "high," and "very high" :

How likely is it that a specific event with potentially negative consequences will occur?

This can be assessed based on the following criteria:

• Interest in misuse: How relevant is the data to third parties, for example, for committing identity theft?
• Feasibility: How much effort is required to cause a specific type of damage?
• Detection risk: How robust are the security measures, and how quickly would misuse be discovered?
• Processing frequency: How often is the affected data processed, where manipulation could potentially occur?

How high is the risk to data subjects across different areas of their lives?

Here, too, it is advisable to use qualitatively assessable criteria to map the severity of the risk for a data subject. Starting points for this could include:

• Infringements on a data subject's right to informational self-determination: Was personal data used for unauthorized marketing purposes, for example?
• Financial impact: Does the data subject incur additional costs or even incalculable financial burdens, such as through identity theft?
• Social consequences for the data subject: Was highly sensitive personal data made public, such as information regarding sexual or political orientation, resulting in exclusion, bullying, or discrimination?
• Health impact: Does the data subject suffer from psychological or physical stress, or even severe depression, as a result?

Why should companies take GDPR risk assessments seriously?

Companies in particular should be aware of the most important aspects when analyzing and assessing the risks of processing activities, as this is a core data protection obligation.

Knowledge of how to conduct targeted, practical risk assessments can simplify data protection within a company and reduce not only the risks to data subjects, but also corporate risks, such as:

• Loss of reputation
• Fines
• Claims for damages

You want to carry out your GDPR risk analysis efficiently?

The privacy experts at Proliance support you with industry expertise and solid experience in implementing GDPR requirements in companies.

More about the external DPO

Risk assessment in practice: Examples from everyday business

In practice, it is advisable for companies to conduct a data protection risk assessment according to a specific pattern . The following examples show how this can be achieved.

Example 1: IT risk assessment with a scenario-based risk profile

• Initial scenario: A company has only one IT security employee who is the only person familiar with the procedures for a data breach.

• Risk scenario: Absence of the IT security employee due to illness

• Description of potential damage: Data breach, for example due to a virus hidden in an employee's email that accesses personal data

• Vulnerability: IT security officer has no deputy

• Impact of the damage: In the worst-case scenario, the entire corporate network is compromised, bringing operations to a standstill

• Reason for the scenario occurring: The IT security officer has no qualified deputy, meaning all expertise is concentrated in one person

• Damage class: Very high

• Probability of occurrence: high

Example 2: IT risk analysis with a risk matrix

Unsure how to assess a risk? A visual representation of risks using a matrix can help. The IT risk example used above can be illustrated and categorized in a standard risk matrix in this way.

How Proliance 360 supports medium-sized companies with risk analyses and DPIAs

If you want to effortlessly identify and minimize GDPR risks in your company, the Proliance 360 software supports you with pre-designed and practical solutions. Personal support is provided by an external data protection officer from Proliance. Our experts will assist you quickly and reliably in analyzing risks within your processing activities. If the risk analysis reveals high risks, an external data protection officer will be on hand to provide professional guidance on the next steps.