Data protection risk is much more than the odds of receiving a fine from the Information Commissioner’s Office (ICO).
Poor management of personal data can harm the people whose information an organisation holds, but it can also create significant risks for the organisation itself. These can include financial loss, disruption to services, legal claims, contractual problems, reputational damage and loss of trust.
Effective GDPR compliance should therefore form part of an organisation’s wider approach to risk management.
Like all risk management the key is to understand what could go wrong, the consequences if it does, and the controls that can reduce either the likelihood or impact of that risk.
Here are seven common areas where organisations can expose themselves and the people whose information they process to unnecessary data protection risk.
Mismanaging Special Category or Other Sensitive Data
Not all personal data creates the same level of risk.
A person’s name and business email address, for example, will generally create different risks from information about their medical history.
The UK GDPR recognises this by providing additional protection for certain types of information known as special category data. This includes personal data concerning matters such as:
- health;
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- certain biometric data;
- sex life; and
- sexual orientation.
Organisations may also hold other information that is particularly sensitive even though it does not meet the legal definition of special category data. Financial information, safeguarding records, information about children and confidential employment information are obvious examples.
What are the risks?
Mismanagement of sensitive information can have particularly serious consequences for individuals.
Disclosure could lead to discrimination, embarrassment, financial loss, distress or other harms.
Alongside the harm to individuals the consequences for the organisation can include:
- complaints;
- compensation claims;
- regulatory action;
- confidentiality breaches;
- reputational damage; and
- loss of employee, customer, patient or service-user trust.
There is also a basic compliance risk. Processing special category data generally requires both an appropriate Article 6 lawful basis and an Article 9 condition.
How can the risk be managed?
Organisations should first understand what sensitive information they hold and why.
Access should be limited to people who genuinely need it, with appropriate technical controls such as encryption and access restrictions.
Depending on the circumstances, other measures could include:
- data classification;
- Data Protection Impact Assessments (DPIAs);
- appropriate policy documentation;
- additional confidentiality requirements;
- staff training;
- access monitoring;
- periodic access reviews; and
- anonymisation or pseudonymisation.
The more sensitive the information and the greater the potential consequences for the individual, the stronger the controls are likely to need to be.
Poor Data Security
The UK GDPR requires organisations to protect personal data through appropriate technical and organisational measures.
It is tempting to think of this principally as an IT problem. That is understandable. Malware, ransomware, compromised accounts and attacks on networks can result in enormous quantities of personal data being lost or exposed.
But many data security incidents are much less sophisticated.
They can involve:
- sending an email to the wrong person;
- leaving paperwork unattended;
- sharing passwords;
- losing a laptop or telephone;
- inappropriate employee access;
- discussing confidential information where others can hear it;
- insecure disposal of records; or
- employees using unauthorised applications or personal devices.
What are the risks?
Poor security can result in the loss, alteration, destruction or unauthorised disclosure of personal data.
For an organisation, the consequences can extend far beyond the information itself.
A significant incident might cause:
- business interruption;
- loss of access to critical systems;
- financial losses;
- regulatory action;
- contractual liabilities;
- compensation claims;
- reputational damage; and
- loss of customer confidence.
How can the risk be managed?
Effective information security requires a combination of people, processes and technology.
Technical measures might include:
- multi-factor authentication;
- encryption;
- access controls;
- software patching;
- vulnerability management;
- secure backups;
- network and device security; and
- monitoring.
These should be supported by organisational measures such as security policies, staff training, supplier assurance, incident-response arrangements and business-continuity planning.
The important question is not simply whether security controls exist, but whether they are appropriate to the risks and whether the organisation knows that they are working.
Retaining Personal Data for Too Long
Keeping information “just in case” can seem harmless.
In reality, retaining personal data without a continuing need creates risk without necessarily creating any corresponding organisational benefit.
The UK GDPR’s storage limitation principle requires personal data to be kept for no longer than necessary for the purposes for which it is processed.
What are the risks?
The more information an organisation retains, the more information potentially exposed if something goes wrong.
Imagine two organisations suffer identical cyberattacks.
One has properly managed its records and holds only the customer information it currently needs.
The other has retained ten or fifteen years of historical customer records unnecessarily.
The same security failure could have dramatically different consequences.
Excessive retention can also:
- increase storage and management costs;
- make subject access requests more difficult;
- increase the volume of information involved in litigation or investigations;
- result in decisions being made using outdated information; and
- make it harder to understand what information the organisation actually holds.
How can the risk be managed?
Organisations should establish a retention schedule identifying how long different categories of information need to be retained and why.
Retention periods should take account of:
- the purpose for which information is held;
- statutory requirements;
- regulatory requirements;
- contractual considerations; and
- legitimate organisational needs.
Where possible, deletion should be automated.
Organisations should also conduct periodic disposal exercises, define responsibility for records and ensure that information is destroyed securely.
There will sometimes be legitimate reasons to suspend normal deletion—for example, where information must be preserved for litigation or an investigation—but these should be managed as exceptions rather than allowing information to accumulate indefinitely.
Failing to Anonymise or Pseudonymise Data Where Appropriate
Anonymisation and pseudonymisation can be powerful ways of reducing data protection risk.
But the underlying question should not simply be:
“Can we anonymise this data?”
A better question is:
“Do we actually need to know who these people are?”
Organisations sometimes use identifiable personal data for activities such as research, analysis, reporting or service planning when identification adds little or nothing to the purpose.
What are the risks?
Using identifiable information unnecessarily increases the consequences if that information is:
- lost;
- stolen;
- accessed inappropriately; or
- disclosed accidentally.
It may also result in more employees having access to identifiable information than necessary.
How can the risk be managed?
Where identification is unnecessary, organisations should consider whether information can be anonymised.
Properly anonymised information is no longer personal data because individuals cannot be identified from it.
Where an organisation still needs the ability to reconnect information to individuals, pseudonymisation may instead reduce risk.
Identifiers might, for example, be replaced with reference numbers while the information required to reconnect those numbers with individuals is stored separately with much more restricted access.
Pseudonymised information remains personal data and is still subject to the UK GDPR.
Whichever approach is used, organisations should also consider the possibility of re-identification. Removing names does not necessarily make information anonymous if individuals can still be identified from other information in the dataset or by combining it with information available elsewhere.
Failing to Understand the Controller and Processor Relationship
Organisations increasingly depend upon third parties to process personal data.
These might include:
- cloud providers;
- payroll companies;
- IT support providers;
- software platforms;
- marketing providers;
- outsourced service providers.
A common mistake is treating the controller/processor relationship primarily as a contractual issue.
The contract matters, but it comes later in the process.
What are the risks?
If organisations misunderstand their respective roles, responsibility for data protection can become unclear.
This can lead to:
- inadequate contractual arrangements;
- processing outside the organisation’s instructions;
- poor security;
- difficulties responding to subject access requests;
- delayed breach reporting;
- uncontrolled use of sub-processors;
- international-transfer problems; and
- disputes over responsibility when something goes wrong.
How can the risk be managed?
The better sequence is:
Understand the processing → Determine the roles → Assess the supplier → Agree the controls → Put the appropriate contract in place → Monitor the relationship
Where an organisation is a controller using a processor, the contract must meet the requirements of Article 28 of the UK GDPR.
But signing a compliant contract is not enough.
Controllers should conduct appropriate due diligence before appointing processors and obtain sufficient assurance about matters such as:
- security;
- confidentiality;
- sub-processors;
- breach management;
- assistance with data subject rights;
- deletion and return of information; and
- international processing.
Supplier assurance should also continue throughout the relationship rather than ending once the contract is signed.
Sharing Personal Data Inappropriately
Organisations frequently need to share personal data.
Sharing may occur between departments, with suppliers, partner organisations, public authorities or other third parties.
The risk is not simply that organisations might share too much information.
There are actually two potential problems:
sharing information when you should not
and
failing to share information when you should.
The latter can be particularly important in areas such as healthcare, safeguarding and public services.
What are the risks?
Inappropriate sharing can result in:
- unlawful disclosure;
- breaches of confidentiality;
- excessive disclosure;
- loss of control over information;
- fraud or identity theft;
- complaints;
- contractual breaches;
- regulatory action; and
- reputational damage.
Equally, an excessively risk-averse approach to data protection can prevent legitimate and necessary information sharing.
“GDPR says we can’t share it” should not become a default response to a difficult decision.
How can the risk be managed?
Before sharing personal data, ask:
- Why are we sharing it?
- What information actually needs to be shared?
- Who needs to receive it?
- What is our lawful basis?
- Are there additional requirements for special category data?
- What risks does the sharing create?
- How can those risks be controlled?
Controls might include:
- data minimisation;
- verification of recipients;
- secure transfer methods;
- data sharing agreements;
- DPIAs;
- access restrictions;
- staff training; and
- documenting significant sharing decisions.
The objective should be appropriate information sharing, rather than only minimising the amount of sharing that occurs.
Failing to Identify and Respond to Personal Data Breaches
When people hear the words “data breach”, they often imagine a cyberattack.
But the legal definition is much broader.
A personal data breach involves a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.
A breach could therefore be:
- an email sent to the wrong recipient;
- missing paperwork;
- an employee accessing records without authorisation;
- a lost laptop;
- information accidentally deleted;
- a cyberattack; or
- personal data disclosed to the wrong organisation.
What are the risks?
An organisation cannot properly manage a breach it does not know has happened.
Failure to identify and report incidents internally can allow problems to continue and increase the harm suffered by individuals.
It can also mean that an organisation:
- fails to contain the incident;
- misses applicable regulatory notification deadlines;
- fails to notify affected individuals where required;
- loses important evidence;
- cannot properly assess what happened; or
- allows the same failure to happen again.
If a breach is reportable to the ICO, the UK GDPR generally requires notification without undue delay and, where feasible, within 72 hours of becoming aware of it.
This makes effective internal reporting particularly important.
How can the risk be managed?
Employees need to understand both what a personal data breach looks like and how to report one.
Organisations should establish a simple reporting mechanism supported by:
- staff training;
- clear escalation arrangements;
- an incident register;
- rapid triage;
- containment procedures;
- risk assessment;
- appropriate DPO or information governance involvement; and
- processes for deciding whether regulatory or individual notification is required.
The process should not end when the immediate incident has been resolved.
Significant breaches should be investigated to understand their root causes and identify lessons.
Ask:
- Why did this happen?
- Did an existing control fail?
- Was a control missing?
- Could the same thing happen elsewhere?
- What needs to change?
This turns breach management from a reactive compliance exercise into a tool for improving organisational resilience.
Managing GDPR Risks: Think Beyond Compliance
These seven risks illustrate an important point about data protection.
Good GDPR compliance is fundamentally about managing risk to people and organisations, rather than simply producing policies and completing compliance documentation.
A useful approach to each processing activity is to ask:
- What could go wrong?
- Why could it happen?
- Who could be harmed?
- What would the consequences be for the organisation?
- What controls reduce the likelihood of it happening?
- What controls reduce the impact if it does?
- How do we know those controls are working?
That final question is particularly important.
An organisation might have a retention policy, security policy, breach procedure, data processing agreement and staff training programme. Their existence provides some evidence of compliance.
But accountability requires organisations to go further.
Are records actually being deleted in accordance with the retention schedule?
Are access controls regularly reviewed?
Do employees recognise and report data breaches?
Are processors complying with their contractual obligations?
Are information-sharing decisions being made appropriately?
Do staff follow the policies they have been given?
Conclusion
Data protection risks cannot be eliminated entirely.
Organisations need to process personal data to employ staff, provide services, manage customers, meet legal obligations and perform countless other everyday activities.
The objective of GDPR risk management is therefore not to prevent the use of personal data. It is to ensure that organisations understand what information they hold, why they need it, what could go wrong and what proportionate controls are required.
Mismanagement of sensitive information, poor security, excessive retention, unnecessary use of identifiable data, poorly understood supplier relationships, inappropriate information sharing and ineffective breach management can all create significant organisational risks.
Policies, procedures and technical controls are important responses to those risks. But their existence is not enough.
A mature approach to data protection asks a further question:
Can we demonstrate that our controls are actually working?
That is where data protection moves beyond simply complying with the GDPR and becomes part of effective organisational risk management and accountability.