System and method for providing data privacy risk of data privacy related data objects for assigning an access right

A system for providing a data privacy risk of data privacy related data objects comprising data related to individuals for assigning an access right for processing and storing the data objects, the system comprising:

• a data extraction module configured to receive data objects and extract data from the data objects,
• an identity definition module configured to generate at least one identity space, wherein the at least one identity space comprises the data objects which comprise extracted data elements concerning a group of individuals or a subset of the group of individuals, wherein the extracted data elements are extracted data which can be related to an individual, and wherein the group of individuals differs from the group of individuals of each other identity space,
• a privacy risk calculation module configured to calculate at least one privacy risk for each identity space and for the individuals in each identity space depending on re-identification probabilities of each individual based on the extracted data elements in the at least one identity space and depending on a set of background knowledge which is assumed to be known, an export module configured to export the extracted data and export the calculated privacy risk, and
• a risk mitigation module configured to perform at least one mitigation function on the extracted data of the at least one identity space if the calculated privacy risk exceeds a predefined threshold value, and resulting in mitigated data with a reduced re-identification probability of each individual, provide the mitigated data to the privacy risk calculation module, which is configured to calculate a new privacy risk based on the mitigated data of the at least one identity space and output the mitigated data and the new privacy risk via the export module.