significant risk

A classification or threshold judgment applied during risk assessment that identifies a risk whose combination of likelihood and potential impact — including harm to individuals (financial, reputational, physical, or rights-related), to organizational operations, or to both — is severe enough to compel a mandatory response: escalated controls, a formal impact assessment, breach notification, or cessation of the activity. Risk is commonly calculated as a function of likelihood and impact, and in privacy and security contexts a primary consideration is harm to individuals, not just organizational impact. Under HIPAA/HITECH, for example, the concept is operationalized as a breach that "poses a significant risk of financial, reputational, or other harm to the individual," making the threshold determination a prerequisite for breach-notification obligations. In U.S. state privacy law, the parallel trigger is "significant risk to consumers' privacy," which requires a formal risk assessment before the activity may begin. Across frameworks the expression functions as a gate: risks below the threshold may be accepted or mitigated in the ordinary course, while risks that meet or exceed it tr