RISK ANALYSIS FOR ALL DATA PROCESSING ACTIVITIES. All single processing activities of personal data must be listed in overview (independent from criticality of the personal data). The list must be created, maintained and updated by the data controller. The overview will be the basis for the risk analysis. For all processing activities of personal data the following information is required: • Processing activity • Description of the processing activity • Data Types and contained data (e.g. personal data, financial data, working data, …) • Legal basis for the processing activity • Responsible of the processing activity (Person, Position, Company) • Purpose of the processing activity • Affected parties of the processing activity • Criticality of the processing activity (in terms of confidentiality, availability and integrity) • Deletion period of the processing activity On each processing activity the risk analysis must be applied. Following details need to be described and evaluated: • Risk description (e.g. unauthorized access to personal data) • Potential harm for affected party • Description of technical and organizational measures • Classification of risk in dependency on probability and severity of risk (e.g. low, medium, high, …) • Risk handling (e.g. accept risk, moderate or eliminate risk probability by implementing additional measures, …) • Re-classification of risk in dependency on probability and severity of risk (e.g. low, medium, high, …) in case additional measures will be implemented
