Assessment

Privacy, Compliance & Data Ethics Risk Assessment

Interactive assessment to evaluate privacy, compliance, and ethical risks for a dataset or analytics project and capture recommended mitigations and owners.

Interactive Tool

Privacy, Compliance & Data Ethics Risk Assessment

This short assessment helps teams identify privacy and compliance risks, ethical concerns, and practical mitigation steps before analytics or model work begins. Complete each field to create a documented record that can be reviewed by data owners, privacy officers, or governance teams.

Name or identifier for the analytics project or dataset.
Who completed this assessment.
YYYY-MM-DD or another date format.
Brief description of the data, sources, and intended analytic use.
Choose the closest classification for the dataset.
Select Yes if the dataset includes direct or indirect personal identifiers.
Select known categories.
Select regulations that may apply to this data or project.
If consent exists, it should be documented and scoped to the analytic use.
Describe consent wording, opt-out mechanisms, and permitted uses. If no consent, explain legal basis for processing.
Retention and deletion schedules limit long-term risk.
If known, provide retention duration in months.
Estimate the risk that individuals could be re-identified from this dataset or combined outputs.
1.0 10.0
Pseudonymization reduces direct identifier use but may not eliminate re-identification risk.
Describe methods (hashing, tokenization, suppression, generalization, differential privacy, synthetic data, etc.).
Consider model accuracy, fairness, and verification needs when deciding on synthetic data.
Where will data or model outputs be shared?
List technical, organizational, legal, and monitoring controls to reduce identified risks (examples: access controls, encryption, data minimization, DPIA, contractual clauses).
Determine an overall risk level combining sensitivity, legal exposure, re-identification risk, and sharing.
Suggested governance step after assessment.
Data owner, privacy officer, or project lead responsible for implementing controls.
Any other context, stakeholder concerns, or follow-ups required.
You can explore this tool now. Sign in or create an account to save your responses and return to them later.
Sign In to Save Create an Account
Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.
Discuss Ask the Librarian

Discussion

Comments and conversation will live here.