Incorrect assessments of the need to protect their personal data represent another danger to persons/employees. These protection needs, which an organisation typically determines itself when it is responsible for processing personal data, can be inaccurate or insufficient for various reasons:

• The organisation has not considered the catalogue of data protection goals that extends beyond information security.
• When determining the protection needs, the organisation did not distinguish between the risks regarding the implementation of data subjects' fundamental rights and the risks to the organisation.
• Although the organisation did distinguish between these two protection interests, it has designed the functions of its procedure and its protective safeguards in its own favour or to the disadvantage of data subjects.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)