Assessment of potential risks and possible mitigations Principle 1 : Purpose of collection of personal information Ref. no. Purpose of Description of the Rationale and Existing controls Assessment of residual Recommended Residual risk collecting the risk consequences that contribute to current risk mitigations or remaining despite information for the agency manage risks privacy new safeguards or individual identified enhancements Identify each Describe any Explain why Document the Assess the likelihood of Include Detail any aspect of the vulnerability and this is an systems and the risk eventuating recommendations remaining project that the risk identified issue; the safeguards (high, medium or low) for how these vulnerabilities in the raises privacy (that is, that could potential currently in place and how severe the residual risks can design that need to issues upset the project) adverse that act to minimise harm would be with no be removed, be managed. noting any impact on these identified new protections (serious managed, or Note risk level relevant legal individuals (or risks to minimal) mitigated, or further (high, medium or rules and system the agency) privacy safeguards low) and the likely design needs and the benefit to ensure the severity of harm that you wish individual is without any new to continue to protected safeguards. achieve
Assessment of potential risks and possible mitigations Principle 1 : Purpose of collection of personal information Ref. no. Purpose of collecting the information Description of the risk Rationale and consequences for the agency or individual Existing controls that contribute to manage risks identified Assessment of residual current risk Recommended mitigations or privacy enhancements Residual risk remaining despite new safeguards Identify each aspect of the project that raises privacy issues Describe any vulnerability and the risk identified (that is, that could upset the project) noting any relevant legal rules and system design needs Explain why this is an issue; the potential adverse impact on individuals (or the agency) and the benefit that you wish to continue to achieve Document the systems and safeguards currently in place that act to minimise these identified risks Assess the likelihood of the risk eventuating (high, medium or low) and how severe the harm would be with no new protections (serious to minimal) Include recommendations for how these residual risks can be removed, managed, or mitigated, or further privacy safeguards to ensure the individual is protected Detail any remaining vulnerabilities in the design that need to be managed. Note risk level (high, medium or low) and the likely severity of harm without any new safeguards.
Template-3-Risk-and-Mitigation-Table-Part-2-Appendix-B.docx