Focus area · PRV
Data-privacy exposure, measured against enforcement reality
Privacy law looks similar on paper in many countries and differs sharply in practice. We show which authorities enforce, what they fine and where your data flows meet the strictest regimes.
Same rules, different enforcement
Privacy risk is driven by three things: the regime, the authority's enforcement appetite and your processing. The GDPR sets one standard across the EU, yet fine levels and priorities vary widely between authorities. Outside the EU, regimes range from GDPR-style laws to data-localisation and state-access rules.
This focus area covers legal and regulatory compliance risk. Information security and cyber risk are outside our scope.
Legal frameworks we map
We map the regimes that apply to your footprint. Typical anchors:
- GDPR
- Regulation (EU) 2016/679, with fines of up to 4 % of worldwide annual turnover (Art. 83), enforced by national data-protection authorities and coordinated through the European Data Protection Board.
- Germany: BDSG and state authorities
- The Federal Data Protection Act and the supervisory authorities of the federal states, with employee data as a recurring focus.
- International data transfers
- Chapter V GDPR: adequacy decisions including the EU-US Data Privacy Framework, standard contractual clauses and transfer impact assessments.
- National privacy laws
- For example Brazil's LGPD, China's PIPL, India's DPDP Act and US state laws such as the CCPA, mapped for each country in scope.
- Data localisation and state access
- Requirements to store data locally or grant authorities access, which can conflict with GDPR obligations.
This is a risk analysis, not legal advice. Where a finding raises a legal question, we say so and you take it to counsel.
What we look at
External analysis
Your exposure as the outside world sees it.
- Enforcement record and fine levels of the data-protection authority in each country
- Privacy cases in your sector and at your direct competitors
- Transfer regime and adequacy status per country
- Localisation and state-access requirements
Internal analysis (under NDA)
Your exposure as your own data shows it.
- Categories of personal data and processing per country
- Cross-border data flows and transfer mechanisms in use
- Internal incidents, complaints and authority enquiries
- Employee monitoring and the use of personal data in investigations and whistleblowing
Seven focus areas, mapped against every source we read.
| Module 1 · External analysis | Module 2 · Internal analysis (NDA) | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Focus area | Law & regulation | Enforcement record | Sector cases | Competitor cases | Indicators | Internal cases | Business partners | Sponsoring, donations, memberships | Gifts & hospitality |
| ABCAnti-bribery & corruption | Core source | Core source | Core source | Core source | Core source | Core source | Core source | Core source | Core source |
| AMLAnti-money laundering | Core source | Core source | Core source | Core source | Core source | Core source | Core source | Where relevant | Not used |
| ATRAntitrust & competition | Core source | Core source | Core source | Core source | Where relevant | Core source | Where relevant | Core source | Where relevant |
| FRDFraud | Core source | Core source | Core source | Core source | Where relevant | Core source | Core source | Where relevant | Where relevant |
| PRVData privacy | Core source | Core source | Core source | Core source | Where relevant | Core source | Where relevant | Not used | Not used |
| EXCExport control & sanctions | Core source | Core source | Core source | Core source | Where relevant | Core source | Core source | Not used | Not used |
| HRTHuman rights | Core source | Core source | Core source | Core source | Where relevant | Core source | Core source | Where relevant | Not used |
Highlighted row: PRV · Data privacy
Typical red flags
- Transfers to countries without an adequacy decision and without a documented transfer assessment
- Employee monitoring or background checks in jurisdictions with strict employment-privacy rules
- Marketing based on purchased or enriched contact data
- Health, financial or children's data in core processes
- Authorities with a record of high fines in your sector
- Localisation requirements in markets where you run central systems
Sources
- Decisions and fines published by data-protection authorities and the EDPB
- Court judgments, including the Court of Justice of the EU
- Third-party enforcement trackers, cross-checked against the authority's own publication
- Statutes and official guidance per country
- No single index: there is no reliable composite measure of privacy enforcement, so we read the record directly
Every finding in the report carries its source and date.
Typically exposed sectors
Exposure tends to be higher where processing of sensitive or large-scale personal data is core to the business: healthcare, financial services and insurance, telecoms, technology platforms, consumer retail and media.
A tendency, not a rating. Your actual exposure depends on business model, customer mix and footprint.
In your deliverable
- PDF: a data-privacy chapter with regime overview, enforcement picture per authority, sector and competitor cases, red flags and recommended measures
- Heatmap row per country × sector with the likelihood × impact rating
- XLSX: case register (authority, year, company, violation, fine, source), transfer-regime table and scoring sheet
- With the internal module: your data flows set against the enforcement picture
Questions on data privacy
Do you assess our IT security?
No. Cybersecurity is outside our scope. We cover the legal and regulatory side: which rules apply, how they are enforced and where your processing creates exposure.
How does this relate to the work of our data-protection officer?
It complements it. The data-protection officer advises and monitors; we provide an external, source-backed view of enforcement risk across countries that the officer and Compliance can both use.
See where privacy enforcement could reach you.
Tell us your countries, sectors and main data flows. We come back with a scope proposal.