An important data processor carrying out an annual risk assessment shall prepare an assessment report in accordance with the template annexed to these Measures. General data processors may prepare an assessment report by referring to the template annexed to these Measures. If the relevant competent authority stipulates otherwise on the risk assessment report template, follow its provisions. Keep risk assessment reports for at least 3 years.

An important data processor carrying out an annual risk assessment shall prepare an assessment report in accordance with the template annexed to these Measures. General data processors may prepare an assessment report by referring to the template annexed to these Measures. If the relevant competent authority stipulates otherwise on the risk assessment report template, follow its provisions. Keep risk assessment reports for at least 3 years.