According to the EU General Data Protection Regulation, the processing of personal data is generally prohibited. Collecting, using, and transferring such data is only permitted when allowed or ordered by a statutory provision, or if the person in question has given express advance consent (see GDPR, Article 6).

From the perspective of data protection, an organisation that collects, uses, transfers, or receives (in summary: "processes") personal data fundamentally poses a risk to individuals. This risk still exists when an organisation's data processing activities are legally compliant.

In contrast, it places individuals at an even higher risk when an organisation does not sufficiently tie its data processing to a specific purpose, interprets this purpose too liberally, or carries out data processing for no specific purpose at all. The same applies if an organisation processes personal data in a non-transparent manner or without safeguards to secure integrity and does not provide data subjects with ways to intervene.

Cases in which data is accessed by third parties in ways that do not serve the purpose of the original data processing in question also present a frequent danger in practice. Such access typically pertains to foreign parent companies, security authorities, banks and insurance companies, public service administrations, IT manufacturers and IT service providers, or research organisations. In these contexts, the justification for access is often not checked—for example, because a long-established practice is being continued. Subordinate employees may also shy away from the personal risk of questioning whether there is a sufficient legal basis for such access. Furthermore, when an organisation's legal department or data protection officer report negative findings in this regard, those in charge often decide not to take corresponding action.

Both individuals and the organisations responsible face further risk if no standard processes are provided for lawful access to IT services or the transmission of data files by third parties. The same applies if no evidence of compliance can be provided in the form of protocols and documentation.

Insufficient data security also poses a significant risk to persons/employees. Recital 75 of the GDPR describes the risks associated with the processing of personal data and the corresponding threat posed by unauthorised access as follows: “The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security safeguards; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.”