The GDPR distinguishes between three risk levels: low risk, risk ("normal") and high risk. In the case of low risk, there are certain exemptions from obligations. In the case of "normal" risk, the severity of the damage and the probability of occurrence can reach a medium level. A high risk includes damage whose extent is serious and/or quite probable. This risk level has significant legal consequences and requires a DPIA.