{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Atech-illegal-data-processing","description":"Processing personal or sensitive data without legal authority, consent, or in violation of regulatory requirements — a data-protection breach with legal, privacy, and reputational consequences.","details":{"category":"privacy","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"tech-illegal-data-processing","taxonomies":["iso-27005-threat","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:tech-illegal-data-processing","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Atech-illegal-data-processing","sourceIds":["ccpa","gdpr","hipaa","nist-800-53","soc2"],"sourceUrl":null,"title":"Illegal processing of personal or sensitive data","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2764e936a870e056cf27912720b627f30ca6a54d59efd44df22189fdf25516cf","properties":{"rationale":"The authorization gate forces security/privacy risk to be assessed before operation, contributing to catching unlawful processing, but the operative lawful-basis/consent/DPIA controls directly prevent illegal data processing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-26-3a91d068.json","sourceId":"uc:UC-AUDIT-26","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:285f3538b77e796a13c6f53dd48d9325e2c57539dd54ce8496f09a649d2237ca","properties":{"rationale":"Requiring new authority/consent before any new purpose keeps processing within lawful bounds.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-03-55121dc9.json","sourceId":"uc:UC-DATA-03","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:35dcf8068d073b1f7ad3a827a3d01d15ac04d0c361d37a42f144ef769b300585","properties":{"rationale":"Prohibiting special-category processing unless a documented legal exception or explicit consent applies directly prevents unlawful sensitive-data processing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-04-2a08628d.json","sourceId":"uc:UC-DATA-04","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:41b7f73e4fe60fabed772b3cde61b49549111b3158d867c81ed21dbe4177d453","properties":{"rationale":"Obtaining valid consent supplies the lawful basis where consent is required, reducing unlawful processing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-02-56e3d60a.json","sourceId":"uc:UC-DATA-02","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f367deff479d4c7d614528c2f1da4f9d912acd4b95c869949e83fbfcbcef805","properties":{"rationale":"Documenting a lawful basis and authority before any collection/processing directly prevents processing without legal authority or consent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4ffcd13da6d34d0736135d6b41a17de0c8d9b11d81c201350b277bc6a189bf3","properties":{"rationale":"Formal agreements specifying purpose, data elements, and verification establish documented authority for the inter-organization matching.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","sourceId":"uc:UC-DATA-18","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"}],"schemaVersion":1}