All organisations, including Estates, need to conduct personal risks assessments. This is particularly important because the extent to which organisation will be fined will depend on whether or not there is evidence of risk assessments being conducted if there is an investigation or breach of personal information