Risk assessment for data protection