Data Risk Assessment

A Data Risk Assessment is the privacy-and-security risk management artefact that pairs with the RoPA. For each processing activity it records the threats (unauthorised access, exfiltration, mis-processing, retention beyond purpose), the inherent risk (likelihood × impact before controls), the controls in place (access control, encryption, logging, DLP, retention automation), and the residual risk after controls. Where residual risk is high, additional measures are required or the processing is reconsidered.

Formal DPIAs under GDPR Article 35, DPDP Section 10(2)(c)(i) and PDPA are specific instances of Data Risk Assessment for high-risk processing. The broader risk assessment programme runs across every processing activity — not just the high-risk ones — and is the operational artefact that lets a regulator's mitigation finding (GDPR Article 83(2) factors; DPDP Section 33(2) factors) land in your favour. Mature programmes rerun risk assessments on a defined cadence (annually at minimum, immediately on material change) and feed the output into the next DPIA cycle.