Lesson 5.3: Practical risk assessment for a small company

Module 5 · Lesson 5.3 of 8 · About 30 minutes · Practical risk assessment for a

You do not need a consultant to find your biggest risks. Use this method. This DPDPA 2023 course page explains practical risk assessment for a in plain language.

practical risk assessment for a - DPDPA 2023 course lesson banner

What you will learn about practical risk assessment for a

Run a simple risk exercise
Score likelihood and impact
Create a short fix list

Three questions (practical risk assessment for a)

What can go wrong? How likely is it? How bad would it be? Multiply the scores to rank risks. Fix the top five first.

Risk method

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Sample risk register (practical risk assessment for a)

Risk	L	I	Score	Fix
Phishing steals email login	4	5	20	MFA and training
Lost laptop with customer data	3	4	12	Disk encryption
Vendor breach	2	5	10	Contract and review
Ex-employee still has access	3	4	12	Exit checklist

Worked example

The top score is phishing. The company turns on MFA for all email accounts within a week, reducing the likelihood score from 4 to 2.

Activity (5 minutes) (practical risk assessment for a)

List five risks and score them.

Key takeaway: Review the register every quarter and after every incident.

Check your understanding of practical risk assessment for a

Q1. Risk score is:

Q2. You fix first the:

Q3. How often review?

← Rule 6: the minimum safeguards What is a personal data breach →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for practical risk assessment for a: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.