Risk assessment

There is a formal (ideally 2-3 times per year) risk assessment of the organisation’s approach to data protection and the impact(s) this may have on stakeholder privacy (i.e. consumer, employee, etc.)