The following parties should be involved when conducting a GDPR Risk Assessment:
a) Data Protection Officer (DPO)
b) Legal advisors or other experts
c) IT departments
d) Business units
e) Information security staff
f) Data processors
g) Relevant parties who can identify potential risks associated with data collection, processing, and storage.