Skip to content
ENExplore Calculators

Privacy Risk Calculator

Score privacy risk for a processing activity: data categories, volume, lawful basis, transfers, retention and re-identification.

About Privacy Risk Calculator

Privacy risk is severity to individuals multiplied by exposure, not a compliance checklist score. Special-category and children's data carry the highest severity, and volume uplifts it because a breach affecting ten million people is categorically different from one affecting a hundred. The compliance gap covers the four failures regulators actually pursue: no documented basis, undocumented transfers, collecting more than needed, and being unable to honour subject rights. The cheapest privacy control is deletion: every field you do not collect and every month you do not retain removes risk permanently rather than mitigating it.

Formula

Privacy Risk

severity = dataCategory sensitivity plus a volume uplift; complianceGap = mean(lawful basis, transfers, minimisation, subject rights); risk = severity × mean(re-identification, complianceGap) ÷ 10, uplifted 15% for automated decisions with legal effect.

severity
Harm to individuals if the processing goes wrong
complianceGap
Weakness in the legal and operational basis for processing
reidentification
How readily derived data can be linked back to a person

Worked example

With the default values below, Privacy Risk Calculator returns Privacy Risk Band of Medium. Change any input above and every figure here is recalculated in your browser.

Inputs used

Most sensitive data categoryone of Business contact details — 3, Personal identifiers and behaviour — 5, Financial or location data — 7, Special category — health, biometric, beliefs — 9, Children's data — 10
Financial or location data — 7
Data subjects affectedaccepts 1–5,000,000,000 people
500,000 people
Lawful basis and transparencyone of Explicit consent, clearly informed — 2, Contract or legal obligation — 3, Legitimate interest with assessment — 5, Unclear or undocumented basis — 9
Legitimate interest with assessment — 5
Cross-border transfersone of None — data stays in region — 2, Adequacy decision applies — 3, Standard contractual clauses plus assessment — 6, No transfer mechanism documented — 9
Standard contractual clauses plus assessment — 6
Data minimisationone of Only fields with a documented purpose — 2, Some surplus fields retained — 6, Everything collected by default — 9
Some surplus fields retained — 6
Re-identification risk of derived datasetsone of Aggregated with differential privacy — 2, Pseudonymised with keys held separately — 4, Pseudonymised with keys alongside — 6, Directly identifiable — 9
Pseudonymised with keys alongside — 6
Automated decisions with legal effect
No
Ability to fulfil access and erasure requestsone of Automated across all stores — 2, Manual but complete — 5, Incomplete — some stores unreachable — 9
Manual but complete — 5

Results

Privacy Risk Band
Medium
Privacy Risk Score
4.60 / 10
Severity to Data Subjects
8.00 / 10
Compliance Gap
5.50 / 10
DPIA Required
Probably not mandatory — document the assessment that reached that conclusion
Highest-Value Control
Drop the surplus fields — the cheapest privacy control is not collecting the data

Step by step

  1. 1Values used
  2. 2Privacy Risk
  3. 3Privacy Risk Band= Medium
  4. 4Privacy Risk Score= 4.60 / 10
  5. 5Severity to Data Subjects= 8.00 / 10
  6. 6Compliance Gap= 5.50 / 10
  7. 7DPIA Required= Probably not mandatory — document the assessment that reached that conclusion
  8. 8Highest-Value Control= Drop the surplus fields — the cheapest privacy control is not collecting the data

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Privacy Risk calculated?

severity = dataCategory sensitivity plus a volume uplift; complianceGap = mean(lawful basis, transfers, minimisation, subject rights); risk = severity × mean(re-identification, complianceGap) ÷ 10, uplifted 15% for automated decisions with legal effect. Privacy risk is severity to individuals multiplied by exposure, not a compliance checklist score. Special-category and children's data carry the highest severity, and volume uplifts it because a breach affecting ten million people is categorically different from one affecting a hundred. The compliance gap covers the four failures regulators actually pursue: no documented basis, undocumented transfers, collecting more than needed, and being unable to honour subject rights.

Why does Privacy Risk matter?

The cheapest privacy control is deletion: every field you do not collect and every month you do not retain removes risk permanently rather than mitigating it.

What values do I need to enter?

This calculator takes 8 inputs: Most sensitive data category, Data subjects affected, Lawful basis and transparency, Cross-border transfers, Data minimisation, Re-identification risk of derived datasets, Automated decisions with legal effect, Ability to fulfil access and erasure requests. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is pseudonymisation enough to take data out of scope?

No. If you or anyone else can re-link it to a person — and holding the key alongside the data means you can — it remains personal data. It genuinely reduces risk, which is why it lowers the score, but it does not remove the obligation.

When is a DPIA mandatory?

In broad terms, for large-scale processing of special-category data, systematic monitoring of public areas, or automated decisions with legal or similarly significant effect. The flag here follows those thresholds, but confirm against your own regulator's published list.

Related Calculators

Privacy Risk Calculator – Calculate Privacy Risk Band