# Regulatory Standards -- DPIA Risk Scoring

## Primary Legislation

### GDPR Article 35(7)(c) -- Risk Assessment Requirement
A DPIA shall contain "an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1."

### GDPR Article 35(7)(d) -- Mitigation Measures
A DPIA shall contain "the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation."

### GDPR Article 36(1) -- Prior Consultation Trigger
"The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk."

### GDPR Recital 75 -- Risk to Rights and Freedoms
Enumerates potential harms: discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality of professional secrecy-protected data, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage.

### GDPR Recital 76 -- Risk Assessment Methodology
"The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing."

## International Standards

### ISO/IEC 29134:2023 -- Guidelines for Privacy Impact Assessment
- Section 7.4: Risk identification methodology
- Section 7.5: Risk analysis (likelihood and impact scales)
- Section 7.6: Risk evaluation (risk matrices and acceptance criteria)
- Annex A: Example risk criteria and scales

### ISO 31000:2018 -- Risk Management
- Clause 6.4: Risk assessment framework (identification, analysis, evaluation)
- Provides the foundational risk management vocabulary used in DPIA scoring

### NIST Privacy Framework v1.0 (2020)
- Core Function: Identify-P (risk assessment)
- Profiles for acceptable risk thresholds
- Integration with enterprise risk management

## Regulatory Guidance

### ENISA Recommendations on DPIA (2019)
- Provides threat taxonomy for privacy risk identification
- Maps threats to rights and freedoms impacts
- Recommends 4-level severity and likelihood scales
- Includes worked risk scoring examples

### EDPB WP248rev.01 -- DPIA Guidelines
- Section III.C: "Assess necessity and proportionality" and "manage risks"
- Emphasises that risk is assessed from the perspective of data subjects, not the controller
- Risk assessment must consider both compliance risks and rights/freedoms impacts

### CNIL DPIA Methodology (PIA Tool v3, 2024)
- Two-axis risk scoring: severity of potential events and likelihood of threat scenarios
- Four severity levels aligned with Recital 75 harm categories
- Provides sector-specific risk catalogues

### ICO DPIA Guidance (2023)
- Step 5: "Identify and assess risks"
- Recommends distinguishing between corporate risk and risk to individuals
- Provides risk assessment template with severity/likelihood matrix

## Enforcement Context

### EDPB Guidelines 04/2022 on Administrative Fines
Supervisory authorities assess the "degree of damage suffered by data subjects" when determining fine amounts, using severity frameworks consistent with DPIA risk scoring.

### BfDI Guidance on DPIA Risk Assessment (2022)
German federal DPA recommends ENISA-aligned four-level scales and requires controllers to demonstrate how residual risk was reduced below the prior consultation threshold.