Templates and records · ISO 27701 · Clause 6.1.2 y 8.2

ISO 27701 privacy risk assessment template

The analysis that decides which controls are needed: what could go wrong with personal data, how much harm it would do to people and who looks after each risk.

In one sentence

The privacy risk assessment identifies the risks linked to processing personal data, estimates their likelihood and their consequences for individuals and for the organisation, compares them with the acceptance criteria and gives each one an owner, because clauses 6.1.2 and 8.2 of ISO/IEC 27701:2025 require the process to be defined, applied at planned intervals and its results retained.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 27701 · Clause 6.1.2 y 8.2 The 2025 edition is cited: numbers 4 to 10 are clauses; A.1, A.2 and A.3 are the Annex A tables with the controls for the controller, for the processor and common to both.
Type of information: Mandatory record Documented information to be retained (6.1.2 and 8.2)
Who fills it in: PIMS manager, with the owners of the processing activities The data protection officer advises; the owner accepts the residual risk
When: At planned intervals and when significant changes occur Typically an annual review plus another whenever a new processing activity or system comes in
How long it is kept: Set by the organisation Neither the standard nor the GDPR sets a period for the record itself; the storage limitation principle (GDPR art. 5(1)(e)) means whatever period is chosen has to be justified.

What the standard requires

What ISO 27701 demands and what it leaves to your judgement

The standard requires a defined privacy risk assessment process with acceptance and assessment criteria, producing consistent, comparable results, applied to identify, analyse and evaluate risks along with their owners. The method —qualitative, matrix-based, scenario-based— is the organisation’s choice.

The assessment is repeated at planned intervals and whenever significant changes occur (8.2), and both the description of the process and the results of each assessment must be retained.

What sets privacy apart is looking at harm to individuals, not just to the company. The GDPR points the same way when it calls for measures appropriate to the risk to rights and freedoms (arts. 24 and 32).

Read it in context: Privacy risks and planning, in the ISO 27701 Academy

Structure

Fields the template should include

Processing activity or asset assessed
Risk scenario: what could happen and why
Consequences for data subjects and for the organisation
Likelihood and impact level according to the criteria
Resulting risk level compared with the acceptance criterion
Risk owner
Treatment option and associated Annex A controls
Residual risk and acceptance by the owner
Assessment date and next review

Example

Example: a risk in a fictitious clinic’s patient portal

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Processing activity	ROPA-02 · Appointments and results in the patient portal · Ashgrove Clinic (fictitious)
Scenario	A third party accesses test results through password reuse
Consequences	Disclosure of health data: serious harm to the patient; breach notification and loss of trust
Rating	Medium likelihood × high impact = high risk (acceptance criterion: medium)
Owner	Medical director
Treatment	Mitigate: mandatory two-factor authentication and email alert on login
Residual risk	Low · Accepted by the medical director on 9 April 2026
Review	April 2027, or sooner if the portal changes

At the audit

Mistakes auditors commonly flag

The ISO 27001 security assessment is reused without rating the impact on individuals.
Acceptance criteria are not written down and each assessor scores in their own way.
No risk has an owner outside the IT department.
The assessment was not repeated after bringing in a cloud provider that processes health data.
Nobody with authority has accepted the residual risk.

In Kimobox

How this record is kept in Kimobox

1Risks are logged in the risk matrix with owner, rating and treatment.
2Each risk is linked to the processing activity in the record and to the controls in the statement of applicability.
3The periodic review is scheduled with a due-date alert.
4Related breaches and nonconformities feed the risk map.

Frequently asked questions

What people ask us before getting started

Is it the same as the GDPR impact assessment?

No. The risk assessment covers every processing activity in scope and feeds the system; the article 35 impact assessment is an in-depth analysis, mandatory only when processing is likely to result in a high risk. The first usually flags when the second is needed.

Can it be combined with the ISO 27001 assessment?

Yes, using a single methodology with criteria extended to rate harm to individuals. What will not do is assuming that a security risk that is low for the company is also low for the data subject.

Keep your ISO 27701 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring