<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/recitals/76","url":"https://www.headlesslaw.com/gdpr/recitals/76","title":"Recital 76","family":"l1_recital_view","work_id":"gdpr","view_of":"/gdpr/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2016/679, OJ L 119, 4.5.2016","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","valid_from":"2016-05-04","valid_until":null,"content_id":"08bd7289188c66c6","versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/recitals/76/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/recitals/76/versions/2016-05-04/rev/08bd7289188c66c6","versions_url":"https://www.headlesslaw.com/gdpr/recitals/76/versions","relations_url":"https://www.headlesslaw.com/gdpr/recitals/76/relations","act_url":"https://www.headlesslaw.com/gdpr/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"gdpr","path":"/gdpr/recitals","name":"GDPR","number":"Regulation (EU) 2016/679","celex":"32016R0679","title_official":null,"document_date":null},"position":{"kind":"recital","key":"76","index":76,"articles":173,"annexes":0},"prev":{"path":"/gdpr/recitals/75","key":"75","title":"Recital 75"},"next":{"path":"/gdpr/recitals/77","key":"77","title":"Recital 77"},"act_anchor":""}}} -->
# Recital 76

*In force · Regulation (EU) 2016/679, OJ L 119, 4.5.2016 · Checked against EUR-Lex on 1 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)*

The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective assessment, by which it is established whether data processing operations involve a risk or a high risk.