Elevated-risk factors
Check any that apply. The more you check, the higher the risk band.
Special-category data is processed Health, biometric, racial, religious, sexual-orientation, genetic, or trade-union data is treated as sensitive and requires elevated safeguards under most privacy laws.
Subjects include children or other vulnerable groups Children, asylum seekers, patients, employees in unequal power relationships, or other vulnerable groups need additional protection.
Decisions are made or assisted by automated means Automated decisions with legal or similarly significant effects (e.g., credit, insurance, hiring) require explicit safeguards and the right to human review.
Processing happens at large scale Large numbers of subjects, large volume of data per subject, wide geographic spread, or long-running processing all increase the impact of any incident.
Systematic monitoring of a publicly accessible area CCTV, location tracking, public-Wi-Fi capture, web tracking across sites — all involve people who did not actively choose to be observed.
Data leaves the country of the data subjects Cross-border transfers require an appropriate safeguard (adequacy decision, standard contractual clauses, binding corporate rules) and a documented assessment of the destination country.
Novel or invasive technology is used Biometrics, facial recognition, behavioural profiling, IoT, large-language-model integrations — anything where the privacy implications are not yet well understood.
Subjects cannot easily refuse or withdraw Where consent is the lawful basis but refusing has practical consequences (e.g., losing access to a service), the consent may not be freely given.