The organization shall set and apply a privacy risk assessment process that: sets and keeps up privacy risk criteria, covering both when a risk is acceptable and when assessments are carried out; makes sure that assessments repeated over time give results that are consistent, valid and can be compared; identifies the privacy risks arising from PII processing inside the PIMS scope, covering risks to the organization and risks to PII principals, and names who owns each risk; analyses each risk by weighing its possible consequences and how likely it realistically is, and fixing its level; and evaluates the risks by setting the analysis against the criteria and ranking them for treatment. Where the organization also carries out an information security risk assessment, it shall manage the link between information security and PII protection throughout. The organization shall keep documented information on the process. The first edition's twin assessment, security risk plus privacy risk inside an ISMS, becomes a standalone privacy risk assessment; the transition documents note that the guidance leans on ISO/IEC 27557.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.