Generally, it is the appointed Data Protection Officer’s or the Data Protection Auditor’s task to perform the risk assessment and verify your company’s compliance with data protection.