risk
Illegal processing of personal or sensitive data
Processing personal or sensitive data without legal authority, consent, or in violation of regulatory requirements — a data-protection breach with legal, privacy, and reputational consequences.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- privacy
- domain
- Data Protection & Privacy
- Compliance, Audit & Assurance
- taxonomy
- iso-27005-threat
- nist-privacy-risk
- inherent_rating
- high
Details
- risk_id
- tech-illegal-data-processing
- category
- privacy
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-threat
- nist-privacy-risk
Source
No record-specific source URL is provided.
Connections
- UC-AUDIT-26 — Authorize systems and internal connections before operation mitigates Illegal processing of personal or sensitive data
- strength
- related
- rationale
- The authorization gate forces security/privacy risk to be assessed before operation, contributing to catching unlawful processing, but the operative lawful-basis/consent/DPIA controls directly prevent illegal data processing.
- UC-DATA-03 — Limit personal-data use to stated purposes and minimum necessary mitigates Illegal processing of personal or sensitive data
- strength
- related
- rationale
- Requiring new authority/consent before any new purpose keeps processing within lawful bounds.
- UC-DATA-04 — Restrict processing of special categories of personal data mitigates Illegal processing of personal or sensitive data
- strength
- primary
- rationale
- Prohibiting special-category processing unless a documented legal exception or explicit consent applies directly prevents unlawful sensitive-data processing.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Illegal processing of personal or sensitive data
- strength
- related
- rationale
- Obtaining valid consent supplies the lawful basis where consent is required, reducing unlawful processing.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Illegal processing of personal or sensitive data
- strength
- primary
- rationale
- Documenting a lawful basis and authority before any collection/processing directly prevents processing without legal authority or consent.
- UC-DATA-18 — Govern automated matching of PII under formal agreements mitigates Illegal processing of personal or sensitive data
- strength
- related
- rationale
- Formal agreements specifying purpose, data elements, and verification establish documented authority for the inter-organization matching.