Organisations depend on information to make decisions, deliver services and meet their responsibilities. But that dependence creates risks.
Personal information may be disclosed to the wrong people. Important records may be lost or unavailable. Inaccurate information may lead to poor decisions, while inadequate governance can result in unlawful or inappropriate use.
Managing these risks requires more than cybersecurity measures. Organisations need to understand the information they hold, identify what could go wrong, assess the consequences and put proportionate safeguards in place.
This guide explains how to develop a practical approach to data and information risk management.
What Is Data and Information Risk?
A risk is something that could happen, usually negative, that is made up of two elements:
- likelihood
- consequence
In the context of data and information it is therefore the likelihood of something you did not want to happen occurring, which will have some form of negative impact on your organisation or the individuals your data and information is about.
Cybersecurity Breaches are among the most notorious forms of data risk. These include hacks, phishing attacks, and malware infections that can expose sensitive information.
Insider Threats pose another significant risk, where employees or contractors misuse their access to data, either intentionally or inadvertently.
Data compliance and regulatory risks arise from failing to adhere to laws such as GDPR potentially leading to hefty fines.
Third-party data risks involve vulnerabilities introduced through external vendors or partners.
Lastly, data loss and corruption can occur due to system failures, natural disasters, but by far more often human error.
Why Should Organisations Manage Information Risk?
A failure to identify and take action to reduce data and information risk could result in:
- avoidable data breaches and data losses
- harm to individuals
- increased costs
- reputational harm
- operational disruption
- regulatory action
Effective risk identification and evaluation allows you to target resources and be proactive, reducing costs, disruption and preserving trust.
What Types of Information Risk Should You Consider?
The main risk categories for data and information include:
| Risk category | Examples |
| Confidentiality | Unauthorised access, accidental disclosure, inappropriate sharing |
| Integrity and quality | Inaccurate, incomplete, altered or corrupted information |
| Availability | System outages, ransomware, lost records, failed backups |
| Lawful and appropriate use | Unlawful processing, excessive collection, incompatible reuse |
| Third-party and supply chain | Supplier failures, inappropriate access, inadequate contractual controls |
| Information lifecycle | Excessive retention, insecure disposal, poor records management |
Examples of Data and Information Risk
- Data Breaches:
- Cyberattacks:
-
- Phishing: Tricking employees into clicking on malicious links or downloading attachments.
-
- Malware: Viruses, ransomware, and other malicious software that can steal or encrypt data.
-
- Hacking: Unauthorised access to computer systems or networks.
-
- Social Engineering: Manipulating individuals to divulge confidential information.
- Insider Threats:
-
- Accidental Disclosure: Employees inadvertently sharing sensitive information.
-
- Malicious Insider: Employees intentionally misusing their access to steal or damage data.
- Data Loss:
- Accidental Deletion: Employees accidentally deleting important files or databases.
- Hardware Failure: Loss of data due to hard drive crashes, server failures, or other equipment malfunctions.
- Natural Disasters: Data loss due to fires, floods, or other natural disasters.
- Data Corruption:
- Software Bugs: Errors in software applications that can corrupt or damage data.
- Human Error: Incorrect data entry, modification, or deletion.
- Compliance Risks:
- Non-compliance with regulations: Failure to comply with data protection laws (e.g., GDPR, PECR) can lead to fines and reputational damage.
- Breach of contract: Disclosure of confidential information to unauthorised parties.
- Reputational Risk:
- Loss of customer trust: Data breaches can erode customer trust and damage an organisation’s reputation.
- Negative media coverage: Publicity surrounding a data breach can have a significant impact on an organisation’s image.
By understanding these different types of data and information risks, organisations can take proactive steps to mitigate these threats and protect their valuable data assets.
Identifying and Mitigating Risks
Here is a step by step process to help you identify your data and information risks, and work out what approach you will take for each of them.
Step 1: Understand Your Information
To be GDPR compliant and manage data effectively organisations should have appropriate records management systems in place. For personal data organisations usually need a Record of Processing Activities (RoPA) and they are likely to have inventories, data flow maps and information assets, with appropriate ownership.
If after exploring your data and information there are gaps, or data collection and use is different from what you expected, this raises its own risks which may be critical and should be addressed urgently.
Step 2: Identify Information Risks
After examining your data and information and how it flows into, out of and through your organisation you can consider if there are any vulnerabilities such as:
- inadequate security
- excessive access
- duplication or version control issues
- data being retained for too long
- unnecessary costs from licence fees or software fees you do not need
You should consider the what risks might arise from these vulnerabilities, using the categories above or others you have identified. At this stage you are simply asking “what could go wrong?”. In short you are considering what threats arise from these vulnerabilities.
Step 3: Assess and Prioritise Risks
Each of your threats are risks, to which you should assign:
- likelihood – the chance of the threat happening, and
- consequence – the impact if it did.
You can find out more about evaluating and scoring risks here.
By combining likelihood and consequence into a risk score you can prioritise your risks. Naturally the ones with the highest scores (greatest likelihood of happening, highest consequence if they did) are the once you should priories for action.
Step 4: Decide How to Treat Risks
Your aim should be to reduce the likelihood or consequence – ideally both – of each risk. For some risks however, particularly ones with lower scores, you might decide not to take any action immediately and prioritise others. For high scoring risks, if you cannot identify mitigating action, you might decide to avoid the risk by stopping the activity that presents the risk in the first place.
Some examples of risk mitigation include:
- Data encryption, which is a fundamental measure for protecting data in transit and at rest.
- Access controls ensure that only authorised personnel can access sensitive information.
- Regular backups and disaster recovery planning prepare organisations for potential data loss scenarios.
- Employee training programmes are essential in fostering a culture of data security awareness.
Find out more about risk management approaches here.
Step 5: Implement Appropriate Controls
The control you identify to manage your risks need to be implemented in order to have any effect. Successful implementation will rely on a mix of both technical and organisational measures.
Any technical solutions you put in place are less likely to work if people do not know about them, howe to use them, and what to do if anything goes wrong.
Step 6: Monitor and Review
Continuous monitoring is crucial to adapting to new threats. Data and information risk management is a cycle and not a one-off activity. Reviewing and updating risk mitigation strategies ensures they remain effective over time. Leveraging data analytics can provide insights into emerging risks, allowing for timely interventions.
You should also be able to provide assurance of your risk management activities. This means providing evidence that your work to mitigate risks is having the desired effect. One way of doing this is to test the controls you have selected and providing evidence that they work.
The Role of Information Governance
Information governance provides a framework of assurance and oversight that organisations can rely on to help ensure they are managing risks well. Effective information governance will help answer:
- Who owns and is accountable for the information?
- What policies and standards govern its use?
- How are risks identified, escalated and reviewed?
- How does management obtain assurance that controls are effective?
A small or medium-sized organisation does not necessarily need a formal data governance committee. Clear ownership, proportionate processes and effective oversight may be sufficient. However proportionate and effective data governance is crucial in mitigating data risks. It involves establishing policies, procedures, and standards for data management that align with the organisation’s objectives. A well-implemented data governance framework ensures data accuracy, consistency, and security, thereby reducing potential risks.
You can read more about key elements of information governance here.
Worked Example: Assessing and Controlling an Information Risk
- A financial start up considers it has very low appetite for operational risks. As part of this it puts in place to reduce the risk of an IT failure that could disrupt customer accounts or customer service. It does however have a higher risk appetite for financial risk as it is committed to rapid growth. Therefore it decides to invest heavily in IT security and IT testing including back-up data centres. It therefore reduces the risk of an operational IT failure and manages risks within the bounds of its risk appetite and tolerance.
- A NHS Trust wants to use patient data for machine learning to improve disease diagnosis. However, it also wants to avoid the risk of a previously illness being identified in a patient without being able to treat them. To reduce the risks associated with sharing identifiable data it decides to pseudonymise the records, which helps keep information secure but allows care to be provided it need be through reidentification mechanisms. This reduces both data risks and medical risks at the same time.
Using an Information Risk Register
Many organisations maintain an information risk register. Your highest rated data and information risks may need to go on your corporate risk register, but no matter the level or setting it should capture:
- The risk and its causes.
- Information assets and activities affected.
- Potential consequences for individuals and the organisation.
- Likelihood and impact assessments.
- Existing controls.
- Residual risk.
- Risk owner.
- Agreed actions and deadlines.
- Review dates and evidence of progress.
You can download a free risk register template here.
Common Information Risk Management Mistakes
Typical mistakes in organisations’ information risk management systems include:
- Only assessing risks as a one-off. Risk reviews should be conducted regularly, not least because technology, data needs and organisational structures change over time.
- Not checking that controls are effective. As part of your risk management systems you should seek assurance of effective risk management by testing controls are effective.
- Not assessing appetite for and tolerance of risk. A risk score by itself helps you see risks relative to each other but you might still make a low scoring risk a priority alongside higher scoring risks because it relates to a critical business function.
Information Risk Management Checklist
You can follow this checklist to help ensure you have the right data and information risk management systems in place
[ ] We know what important information we hold and where it is stored [ ] Owners for important information assets have been identified [ ] We understand the main threats and vulnerabilities [ ] Potential consequences for individuals and the organisation have been identified [ ] Consistent criteria to assess and prioritise risks are used [ ] We document existing controls and assess residual risk [ ] We assign an accountable owner to each significant risk [ ] Proportionate risk treatment actions have been agreed [ ] We test whether important controls are working [ ] We maintain an information risk register [ ] Following significant changes or incidents risks are reviewed [ ] Senior management receives appropriate risk and assurance information
Conclusion
Risks require proportionate, but continuous management. By understanding the nature of data risks and implementing comprehensive mitigation strategies, organisations can safeguard their valuable information, prevent disruption and protect their reputations. Proactive risk management ensures resilience in the face of evolving threats, fostering stability for future business success.