A live reference for the risk-rating step of each processing entry — not a substitute for the ROPA itself. Screen for DPIA triggers, rate residual risk to data subjects, trace it back to your ISMS/PIMS controls, then export the summary in Section 5 as evidence for the ROPA entry.

Art. 35(3) mandatory triggers plus the WP248 rev.01 / EDPB nine criteria. Two or more criteria checked → DPIA flag. Any single item marked "mandatory" triggers a DPIA regardless of count. GDPR Art. 35(3), 35(4) · WP248 rev.01

Below the DPIA threshold, this is the rating that populates the ROPA risk column — likelihood × severity of harm to the individual, not to the organisation. Keep this separate from your ISMS CIA risk score. Recital 76 · ISO/IEC 27701 §5.4.1.2

Classification rubric — weighted, not summed. Severity follows ENISA's published breach-severity formula directly: sensitivity and identifiability multiply (a highly identifiable but low-sensitivity dataset shouldn't score the same as a moderately identifiable, highly sensitive one), and aggravating circumstances add on top only if present. Likelihood has no published ENISA equivalent — it's built here by the same structural logic (control weakness × threat capability, plus additive amplifiers) rather than adopted from a standard, and is flagged as such. Override the matrix manually if judgment differs. ENISA, Dec. 2013 — SE = DPC × EI + CB

Matrix highlights from the rubric above. Click any cell directly to override.

Where each step of the ROPA risk process is picked up by your existing certifications, so you're not building parallel documentation.

Step	GDPR	ISO coverage

Beyond the Art. 30(1) minimum, these are the fields that make the risk rating auditable rather than decorative.

Auto-generated from your answers in Sections 1–2 above. Add identifying fields for this processing activity below, then export as PDF to attach to the ROPA entry as evidence of this assessment.

+ Add identifying field Print / Export as PDF