Privacy Risk Assessment and Data Protection Impact Assessments
What this domain tests
Privacy risk assessment tests when a DPIA or data protection assessment is required, how to assess likelihood and severity of harm, and how to document mitigations and residual risk.
Core rules and concepts
- Triggers: high-risk processing such as profiling, sensitive data, systematic monitoring, large-scale data, AI inference, biometrics, or combining datasets. State laws (e.g., Colorado, Connecticut, Virginia) require data protection assessments for targeted advertising, sale, sensitive data, and high-risk profiling.
- Method: describe the processing, necessity and proportionality, data flows, affected individuals, potential harms (physical, emotional, financial, reputational, chilling effects), likelihood, severity, mitigations, residual risk, and approval.
- Harms are broader than security: discrimination, loss of autonomy, inaccurate inferences, and unexpected secondary use count.
- Consultation: involve product, security, legal, and affected business owners; escalate high residual risk to accountable executives.
- Lifecycle: assess before launch, review on material change, and retain evidence.
Worked example
HR proposes facial recognition for office entry. The assessment finds biometric identifiers, continuous monitoring, and possible false matches affecting pay or discipline. Likelihood is moderate, severity high. Mitigations include badge alternative, no disciplinary use, retention limits, accuracy testing, and opt-out. Residual risk remains high, so the CPO and legal approve with conditions.
Traps that cost marks
- Running the DPIA after launch and treating it as paperwork.
- Assessing only confidentiality and ignoring fairness or autonomy harms.
- Stopping at “mitigations added” without rating residual risk.
- Failing to re-assess when the vendor or data use changes.