While existing consumer data privacy laws include similar requirements to complete risk assessments (i.e., data protection impact