Risk register

The risk register lists what could go wrong with personal data, how serious it is, who will fix it and by when.

Where risks come from

• Findings: every No or Partially answer in the gap analysis, and every gap in a completed or approved DPIA. Choose Add suggested risks to group the findings into risks, one per section, or into the active risk that already covers that section.
• Typical risks: for clients in a sector with a list, choose Add typical risks to add the risks organisations in that sector commonly face. Adapt each one to the client.
• Your own risks: choose Add risk at any time.

Recording a risk

• Likelihood and impact, each Low, Medium or High, give the risk’s level: Low, Medium, High or Critical.
• The action that will reduce it, its owner and due date.
• Its status: Open, In progress, Mitigated, Accepted (the organisation has decided to live with it) or Closed.
• The level expected after the action, and the related vDPO module.
• The findings it covers. Ticking a finding that is in another risk moves it here.

Keeping track

The summary shows active, high and critical, and overdue risks, and findings not yet in a risk. The menu badge counts active risks and turns red when one is overdue. Use Risk register report to print the register, or download it as a CSV file.