Privacy Risk Assessment and Management Flashcards

What is the primary objective of a Data Protection Impact Assessment (DPIA)?

Answer: Identify and mitigate privacy risks of high-risk processing activities before they begin

A DPIA systematically analyzes how a high-risk processing activity will affect individual privacy and requires implementing measures to reduce identified risks.

Which factor most commonly triggers the requirement to conduct a DPIA under GDPR?

Answer: Systematic and large-scale processing of sensitive personal data

GDPR Article 35 requires a DPIA when processing is likely to result in high risk, particularly for large-scale processing of special category data or systematic profiling.

In a privacy risk assessment, what is a 'threat' in relation to personal data?

Answer: Any potential cause of an unwanted event that could result in privacy harm to individuals

A threat is a potential event or action — such as unauthorized access or insider misuse — that could exploit a vulnerability and cause privacy harm.

Which risk treatment option involves stopping a high-risk data processing activity because residual risk cannot be reduced to an acceptable level?

Answer: Risk avoidance

Risk avoidance means ceasing or not starting the processing activity entirely when the risk cannot be adequately controlled.

A privacy risk assessment rates risks using 'likelihood' and 'impact'. What does the combination of these two factors produce?

Answer: A risk score or risk level

Risk level = likelihood × impact; this score prioritizes which risks require immediate mitigation versus those that can be monitored.

What is 'residual risk' in the context of privacy risk management?

Answer: The remaining risk after controls and mitigations have been applied

Residual risk is what remains after all identified controls are implemented; it must be accepted, transferred, or reduced further if it exceeds the organization's risk tolerance.