Data privacy risk matrix development