Privacy threshold assessments, privacy impact assessments and data protection impact assessments – used to determine when an organization or one of its vendors will be engaged in processing personal information – are essential tools for managing privacy risk. In this article, we share insights from privacy experts at Paul Hastings and Paramount about the three types of privacy assessments, their interplay with security assessments, how to use responses for risk scoring and risk mitigation, and the intricacies of transfer impact assessments under the GDPR. The panelists spoke at the Privacy+Security Forum Spring Academy. See “Six Practical Tips for Building an Effective Privacy Risk Assessment Program” (Jan. 6, 2021).