Data privacy risk focuses on the potential for regulatory penalties, legal liabilities, and operational restrictions resulting from the unauthorized collection, processing, exposure, or misuse of personally identifiable information (PII). Organizations must manage a complex matrix of regional data protection rules, including the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and specialized industry standards like the Payment Card Industry Data Security Standard (PCI-DSS).
| Regulatory Standard | Primary Compliance Requirement | Maximum Statutory Penalty Impact |
|---|---|---|
| EU GDPR | Mandates a clear legal basis for processing data, grants consumers data erasure rights, and requires breach notification within 72 hours. | Up to 20 Million Euros or 4% of total global annual turnover, whichever is higher. |
| California CCPA | Grants consumers the right to opt out of data sales, access collected profiles, and receive equal service pricing. | Up to $7,500 per intentional violation, calculated per impacted consumer record. |
| PCI-DSS | Mandates encryption of payment card data during transmission and storage, along with regular vulnerability scanning. | Monthly administrative fines, elevated transaction processing fees, or loss of card processing privileges. |