The risk assessment transforms the analysis results into a reliable basis for decision-making.

The key question is: How likely are risks to occur and how great is the potential damage?

In this step, you determine the probability of damage occurring and the possible consequences or amount of damage. The protection of the rights and freedoms of affected individuals is always decisive.

In order to assess the extent of damage and the probability of occurrence as objectively, consistently, and reliably as possible, predefined assessment levels are required.

For reference, graded assessment standards have been established in the field, such as those of the Bavarian State Office for Data Protection (BayLfD) or those of the Data Protection Conference. They distinguish between four levels of probability, from “negligible” (practically impossible) to ‘high’ (probable), and four levels of damage, ranging from “minor inconvenience” to “irreversible consequences.”

In the following overview, we follow the model recommended by the BayLfD: 

Levels of probability of occurrence:

• Minor
  Damage cannot occur according to current expectations.
• Manageable
  Damage may occur, but based on experience to date and the circumstances, it seems unlikely.
• Substantial
  Based on experience to date and the circumstances, damage appears possible but not very likely.
• Major
  Based on experience to date and the circumstances, damage appears possible and very likely.

Levels of damage:

• Minor
  Those affected may experience inconvenience, but they can overcome this with some effort.
• Manageable
  Those affected may experience significant inconvenience, but they can overcome this with some difficulty.
• Substantial
  Those affected may suffer significant consequences that they can only overcome with serious difficulty.
• Major
  Those affected may suffer significant or even irreversible consequences that they cannot overcome.

It is important to note that the initial assessment considers so-called gross risks. These are risks before technical and organizational measures are taken into account. This determines the theoretical maximum risk level.

A risk matrix is a useful tool for visually supporting this assessment. It shows the relationship between the amount of damage and the probability of occurrence, and it facilitates the risk assessment.

The multiplication of the afore-mentioned levels results in an image that looks like this:

The individual fields of the risk matrix can be aggregated into a risk index:

• Red: High risk
• Yellow: Normal/medium risk
• Green: Low risk

Now that the risk assessment has been completed, the subsequent risk mitigation defines how risks can be effectively treated.

The challenge now is to select TOM that directly strengthen the respective assurance objective.

When selecting suitable TOM, responsible parties should consider two levels of action:

The first level relates to technical measures - i.e., everything that directly strengthens security systems: backups, encryption, access controls, etc. These measures have a direct influence on the probability of technical risks occurring.

The second level comprises procedural and organizational optimizations. These include, for example, clear role and responsibility concepts, defined approval processes, training, or regular reviews of data flows. Risk-conscious process adjustments ensure that data protection is not only implemented technically, but also integrated into people's day-to-day work.

Effective TOM are not isolated measures that serve no purpose other than their own. Only when risks, technical and organizational measures, and assurance objectives are meaningfully linked does a coherent system emerge that supports both compliance and operational actions.

The following examples show how assurance objectives are placed in direct context with TOM:

• If data availability is at risk, redundant systems, regular backups, and clearly defined restart times can be helpful.
• When risks to integrity arise, checksums, rights and role concepts, or dual control principles come to the fore.
• Confidentiality, in turn, requires encryption, access restrictions, and training to raise employee awareness.
• Transparency can be ensured through audit logs or traceable documentation, while
• Intervenability and non-linkability are supported through clean data structures, pseudonymization, and separation of processing contexts.
• Data minimization can be ensured by only collecting data that is necessary for its intended purpose, e.g., by reducing the number of mandatory fields in forms or automatically deleting data once the purpose has been fulfilled.

In addition, the SDM modules published by the Data Protection Conference (DSK) as part of the Standard Data Protection Model (SDM) may be consulted.

They provide a useful basis for the targeted use of technical and organizational measures (content is only available in German).

Risk management does not end with the definition and subsequent implementation of TOM. On the contrary: in this step, it is necessary to verify whether the measures taken have actually led to a reduction in risk.

Step 5 represents the final risk assessment. This second assessment cycle, in which the so-called residual risk or net risk is evaluated, is intended to provide evidence that the risks have been reduced to an acceptable level. The residual risk describes the risk after all appropriate TOMs have been implemented.

The probability of occurrence and the amount of damage are now reassessed for the mitigated risks.

The focus should be on traceability: supervisory authorities should be able to see how the organization arrived at its risk assessment.

In addition, it is advisable to regularly review the operational effectiveness of TOM, whether through internal audits, departmental reviews, or audit privileges in contractual relationships.

This involves not only technical checks, but also organizational questions: Are guidelines being followed? Are responsibilities clearly defined? Is employee awareness being maintained?

The final risk assessment is not a one-time event, but a continuous cycle: New projects, systems, or regulatory changes should always involve an update of the risk management system.