• |

    Oct. 21, 2026

Beyond the Risk Assessment: A Practical Framework for Managing Privacy Risk

For privacy practitioners, the critical work often begins after an assessment identifies a potential risk. Once a risk is identified, organizations must determine its significance, evaluate existing controls and decide what action, if any, is necessary. In this guest article, Pari Sarnot, a senior privacy program manager at Electronic Arts, lays out a practical, scalable framework for determining the significance of identified risks and what should happen next. The article addresses how to evaluate controls and residual risk, choose an appropriate risk treatment, document decisions, and monitor and reassess risk over time. The views Sarnot expresses in this article are her own and do not represent those of current or previous employers. See “A Streamlined Approach for Integrating New Requirements Into PIAs” (Dec. 17, 2025).

Strategies to Create and Use Data Maps

Minnesota’s comprehensive privacy law requires organizations to complete personal data inventories, a longstanding best practice that anchors effective responses to incidents, regulators and consumers. Inventorying PI and mapping data flows has clear benefits, but the constant influx of data and use of AI strains organizations’ efforts. This article discusses strategies for building effective inventories, extending them into fuller data maps and making the best use of those maps, with insights from Intuit, Womble Bond Dickinson and the Minnesota representative who was the principal sponsor of its privacy law, along with Contoural and KLC Law experts who spoke during a BARBRI webinar. See “Managing Privacy Across the Cross-Border M&A Lifecycle” (Sep. 16, 2026).

Navigating the Interplay of E.U. Data and AI Laws: Compliance Measures

The E.U.’s expanding web of data and AI laws presents challenges that extend beyond determining how the various regimes interact. Organizations also must monitor evolving guidance and enforcement priorities and translate the GDPR, AI Act, Digital Services Act, Digital Markets Act, Data Act and NIS2 into practical compliance measures. Distilling insights offered during a BARBRI program by attorneys from Anderson & Kreiger and Ogletree Deakins, this second installment in a two-part series examines available guidance and enforcement trends, and offers advice on how organizations can prepare to comply with the laws. Part one provided an overview of the five principal E.U. data laws and directives, and addressed the interplay among those regimes. See our two-part series on cybersecurity obligations in the E.U.’s digital laws: “AI Act, CRA and NIS2” (Sep. 4, 2024), and “Data Act, DORA and Compliance Steps” (Sep. 11, 2024).

Most-Read Articles