Securing Personal Data: a risk-based approach