Should we carry out a risk analysis for every processing operation and how often should we do it?

ANSWER

The risk analysis referred to in Article 32 GDPR should be carried out before processing begins or before implementing a new asset involved in processing operations. This is a key element of data protection by design. Our methodology is based on identifying assets and then assigning to them potential threats, technical and organizational safeguards, and vulnerabilities. When changes are made to infrastructure or a new business system is implemented, it is necessary to review the risk analysis and update it to take account of new elements. For the risk analysis to reflect current threats and changing processing conditions, it should be systematically updated. A review at least once a year is recommended, or on other cycles consistent with the organization's policy. In addition, whenever a personal data breach occurs, a reassessment should be carried out to verify the effectiveness of the safeguards applied.