Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / Data protection officer

Data protection officer: its risk register

Decides whether a compromise is a personal data breach and whether the 72-hour clock has started.

Kind role · Assigned here 2 · In its register 2 · the briefing for a data protection officer

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R06 A compromise becomes a reportable breach15 highComplianceownerGDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2
R06-1 Personal data taken from a compromised PHP application15 highComplianceownerGDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20
3 Possible3 6 9 12 15 R06 R06-1
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

People whose data is held in PHP applications (2), Organisations running PHP (1), EU and member-state CERTs (1), Board and executives (1), Managed PHP platforms (1)

The standards its register touches

GDPR (6), NIS2 (1), DORA (1), Cyber Resilience Act (1)