Identify and evaluate privacy risks associated with personal data processing activities. Conduct a full inventory of the organization’s collection, processing, storage, and transmission of personal data types, workflows, and related assets. Establish records of data processing activities, perform risk assessments, analyze potential residual risks and vulnerabilities, and select appropriate risk treatment strategies.