PRIVACY RISK MATRIX

Low Low to Meduim Medium Medium to High High

(Impact insignificant) (Impact minor) (Impact moderate) (Impact major) (Impact catastrophic)

 Information involved is
already in the public
domain
 No loss of public
confidence
 Small risk of reputational
damage
 No sensitive or health
information involved
Privacy
 Small number of individuals
affected and limited
information involved – e.g.
name, business contact
details, email
 No threat to university central
operations
 Limited risk of harm to small
number of individual/s
including financial or
reputational risk
 Limited reputational damage
 No sensitive or health
information involved
 Threat to data integrity
(especially Callista & SAP)
impacting on continuity of
service for limited areas of
university operations
 No threat to university
central operations
 Limited risk of harm to large
number of individual/s
including financial or
reputational risk
 No public exposure
 Limited reputational damage
 Information affected includes
sensitive or health
information
 Information to be transferred
or stored outside of Australia
AND terms included in
contract re complying with
Victoria privacy obligations
 Threat to data integrity
(especially Callista & SAP)
impacting delivery and
continuity of service for
significant areas of university
operations
 Limited threat to university
central operations
 Risk of harm to large
number of individual/s
including financial or
reputational risk
 Public exposure of incident
& limited loss of public
confidence
 Significant reputational
Significant reputational
damage
 Information affected includes
Information affected includes
sensitive or health
information
 Information to be transferred
or stored outside of Australia
AND no terms included in
contract re complying with
Victoria privacy obligations
 Data corrupted or unable to
be accessed (especially
Callista & SAP) resulting in:
− critical university functions
ceasing
− breach of legal obligations
− legal action against the
university
 Serious risk of harm to large
number of individual/s
including financial or
reputational risk

Significant public exposure
of issue & loss of public
confidence

damage

sensitive or health
information
 Information to be transferred
or stored outside of Australia
AND no terms included in
contract re complying with
Victoria privacy obligations

The above matrix address privacy risks associated with the handling of personal, sensitive or health information of students, staff or members of the public in the conduct of the
university operations. It does not include consideration of privacy risks associated with research undertaken by the university.