EU Regulation 2016/679 (GDPR) places the principles of privacy by design and by default at the heart of personal data processing, requiring a proactive approach to data protection by design. Istat has developed an innovative model for the preliminary assessment of the impact of a personal data breach for statistical purposes, using an automated algorithm based on the characteristics of the variables processed. This approach is based on objective criteria, which allow estimating the level of risk in a systematic and uniform way. The model, used in the risk analysis phase, could in the future be integrated within the ‘Integrated Treatment Management System’, allowing the estimation of the impact to be anticipated at an early stage, supporting an effective implementation of the data minimization principle. This experimentation represents a step forward towards an automated privacy management system, capable of prioritizing risk analysis and improving compliance with GDPR requirements, strengthening citizens’ trust in institutions that process personal data on a large scale.