A GDPR risk assessment is a written review of what can go wrong with the personal data you process, how bad it would be for the people the data is about, and what you do to prevent it. It is the basis for choosing an appropriate level of security, as required by Article 32 of the regulation.
There is no official template. The Danish Data Protection Agency emphasises that the assessment is specific and can be documented, and a spreadsheet is enough. Below are the seven steps most organisations can follow.
The difference many overlook
An ordinary business risk assessment asks what an incident costs the company: lost revenue, downtime, bad publicity. A GDPR risk assessment asks what the incident costs the data subjects, meaning the customers, employees or citizens.
That gives different answers. If a list of participants in a stress programme is sent to the wrong recipient, the company is unlikely to lose any money. For the people on the list, it can be serious. The Danish Data Protection Agency describes the difference in its material on security of processing (in Danish), and confusing the two is a typical error.
1. Get an overview of your processing
Begin with your record of processing activities. If you do not have one, make a simple list: What information do we hold, about whom, in which systems, and who has access?
Take one processing activity at a time. “HR data” is too broad. “Recruitment”, “payroll” and “sickness absence” are three different activities, each with its own risk.
2. Describe what can go wrong
Use the three classic security concepts as a checklist:
- Confidentiality: Can unauthorised people gain access to the information?
- Integrity: Can the information be changed or become incorrect?
- Availability: Can the information be lost or become unavailable when it is needed?
Write specific scenarios. “Hacker attack” is too vague. “An employee’s password is stolen through phishing, and the attacker gains access to the payroll system” is a scenario that can be assessed.
Remember the undramatic scenarios. The Danish Data Protection Agency received 9,849 personal data breach notifications in 2025, and the agency itself points to unintentional sharing with the wrong recipient as the most common type. A risk assessment that only deals with hackers therefore misses what happens most often.
3. Assess the impact on the data subjects
For each scenario, ask: What does it mean for the person if this happens? Think of financial loss, identity theft, discrimination, damage to reputation or simply the discomfort of strangers knowing about private matters.
The nature of the information matters a great deal. A leaked work phone number is rarely a problem. Health information, national ID numbers and information about criminal offences are a different matter. The number of people affected and their situation count as well: information about children or vulnerable citizens weighs more heavily.
Most people use a scale from 1 to 4, for example negligible, minor, serious and very serious.
4. Assess the likelihood
How likely is it that the scenario occurs under the conditions you have today? Look at how many people have access, how often the information is sent or moved, whether similar incidents have happened before, and how attractive the information is to criminals.
Be honest. If 40 employees send emails containing personal data every week, the likelihood of a misdirected email over a year is high, however careful they are.
5. Choose measures that match the risk
Impact multiplied by likelihood gives a risk level, and that decides how much you need to do. Article 32 refers to both technical and organisational measures, and an assessment that only lists technology is incomplete.
| Scenario | Impact | Likelihood | Technical measures | Organisational measures |
|---|---|---|---|---|
| Payslip sent to the wrong recipient | 3 | 3 | Send delay, warning for external recipients | Guideline for emails with personal data, training |
| Login stolen through phishing | 4 | 2 | Two-step login, logging | Training in scam messages, clear reporting route |
| Old job applications left on a shared drive | 2 | 4 | Automatic deletion after the retention period | Deletion policy, annual clean-up |
| Laptop stolen | 3 | 2 | Disk encryption, remote wipe | Rules for equipment outside the office |
The numbers in the table are examples. Your own depend on your data and your organisation.
6. Employee behaviour as a risk of its own
Look at the right-hand column of the table. In almost every scenario an employee is involved, either as the person who makes the mistake or as the person who discovers it.
That is why behaviour should be a separate line in the assessment. Who handles sensitive information day to day? Do they know what they may send, and how? Do they know who to call when something goes wrong? Have new employees been introduced before they get access?
Training is the organisational measure most often used to bring that risk down, and it only counts if it can be documented. Record in the assessment who has been trained in what, and when. Our GDPR training is developed together with specialists in data protection law, and the scenarios can be adapted to the processing your employees actually work with. The situations from the risk assessment can then be used as examples in the training.
7. Document it, and come back to it
Write down what you assessed, what you decided, and what risk remains once the measures are in place. Management should approve the residual risk. If you cannot show the assessment, then in the eyes of the Danish Data Protection Agency you have not made it.
Set a date for the next review as well. The assessment has to be updated when you introduce new systems, start processing new types of information or have had an incident, and otherwise at least once a year.
When do you need a data protection impact assessment?
If the assessment shows that a processing activity is likely to involve a high risk to data subjects, Article 35 requires a full data protection impact assessment, often called a DPIA. This typically applies to large-scale processing of sensitive information, systematic monitoring or new technology. The Danish Data Protection Agency keeps a list of processing that always requires an impact assessment at datatilsynet.dk.
Next steps
The GDPR risk assessment is closely linked to the one you make for your IT systems in general. We describe that in the article on IT security risk assessment, and it pays to do the two at the same time. If you would like to look at how training can be included as a documented measure in your organisation, you can contact us.
