DPIA Risk Scoring Methodology

DPIA Risk Scoring Methodology

Overview

Art. 35(7)(c) GDPR requires a DPIA to include "an assessment of the risks to the rights and freedoms of data subjects." This skill provides a quantifiable risk scoring framework that converts qualitative privacy risks into comparable, prioritised scores supporting mitigation decisions.

Risk Scoring Framework

Severity Scale (Impact on Data Subject Rights)

Likelihood Scale

Risk Matrix

Severity →    Negligible(1)  Limited(2)  Significant(3)  Maximum(4)
Likelihood ↓
Maximum(4)        4(M)         8(H)        12(VH)         16(VH)
Significant(3)    3(L)         6(M)         9(H)          12(VH)
Limited(2)        2(L)         4(M)         6(M)           8(H)
Negligible(1)     1(L)         2(L)         3(L)           4(M)

Risk Levels: L=Low(1-3), M=Medium(4-6), H=High(7-9), VH=Very High(10-16)

Risk Categories (ENISA-Aligned)

Rights and Freedoms Impacts

1. Loss of confidentiality -- Unauthorised disclosure of personal data
2. Loss of integrity -- Unauthorised modification of personal data
3. Loss of availability -- Inability to access or use personal data
4. Loss of purpose limitation -- Data used beyond original purpose
5. Discrimination -- Unfair treatment based on processing outcomes
6. Identity theft/fraud -- Misuse of personal data for impersonation
7. Financial loss -- Direct or indirect monetary harm
8. Reputational damage -- Social standing or professional harm
9. Physical harm -- Safety or health impacts
10. Loss of autonomy -- Chilling effects on behaviour or free expression

Inherent vs Residual Risk

• Inherent risk: Risk level before applying any mitigation measures
• Residual risk: Risk level after applying planned mitigation measures
• Risk reduction: Difference between inherent and residual risk scores
• Acceptable risk threshold: Organisation-defined tolerance level

Art. 36 Prior Consultation Trigger

When residual risk remains High or Very High after all feasible mitigation measures, the controller must consult the supervisory authority under Art. 36(1) before commencing processing.