Archlight’s privacy risk/impact assessment (based on GDPR requirements) identifies the controls (existing or planned) to comply with applicable regulatory requirements and the impact of data processing or a data breach attributable to the deficiency or absence of a required control.
Why Conduct a Privacy Risk/Impact Assessment?
In an increasingly connected world, some problems can arise simply from individuals’ interactions with systems, products, and services, even when the data being processed is not directly linked to identifiable individuals. For example, smart cities technologies could be used to alter or influence people’s behavior such as where or how they move through the city. Problems also can arise where there is a loss of confidentiality, integrity, or availability at some point in the data processing such as data theft by external attackers or the unauthorized access or use of data by employees. Data processing includes but is not limited to collection, retention, logging, generation, transformation, use, disclosure, sharing, transmission, and disposal.
Individuals, whether singly or in groups (including at a societal level) experience the direct impact of problems. As a result of the problems individuals experience, an organization may experience impacts such as noncompliance costs, revenue loss arising from customer abandonment of products and services, or harm to its external brand reputation or internal culture.
Privacy risk management considers privacy events as potential problems individuals could experience arising from system, product, or service operations with data, whether in digital or non-digital form, through a complete life cycle from data collection through disposal.
Once an organization can identify the likelihood of any given problem arising from the data processing ( i.e. problematic data action) it can assess the impact should the problematic data action occur. This impact assessment is where privacy risk and organizational risk intersect.
How Can We Help?
Archlight’s privacy risk and impact assessment evaluates against regulatory requirements set forth in key regulations such as GDPR regional regulations. We utilize industry standards and best practices to ensure organizations are able to meet requirements in a cost-efficient and effective manner and minimize negative impact to the organization as a result of operational decisions, strategic initiatives, data breaches resulting from lack of established controls.
