The best way to ensure an organization’s enterprise risk management (ERM) framework can protect the organization from privacy harms is to complete a privacy risk assessment. A privacy risk assessment is a systematic process of identifying, analyzing, evaluating, and treating the privacy risks that may affect the organization’s objectives, operations, stakeholders, and reputation. A privacy risk assessment helps to align the ERM framework with the privacy requirements, expectations, and obligations of the organization, as well as to prioritize and mitigate the privacy risks that may cause privacy harms. Privacy harms are the adverse consequences or impacts that may result from the unauthorized or inappropriate use, disclosure, or loss of personal data, such as financial loss, identity theft, discrimination, reputational damage, emotional distress, or physical harm.