The relationship between production and statistical research and data protection is structured and unavoidable. The convergence and compatibility of the values and principles of personal data protection and statistical research must be defined within the regulatory framework for data protection. The General Data Protection Regulation (EU) 2016/679 (GDPR) adopts a risk-based approach and in accordance with the principle of accountability requires that the Data Controller must guarantee and demonstrate that the data processing is conducted in compliance with and in implementation of the principles established by the GDPR. The generalized obligation to conduct privacy risk assessments, with the consequent obligation to adopt appropriate measures to mitigate the risk identified each time for each statistical purpose pursued, has become an essential component of the skills set required for statistical production and research. This paper presents a methodological proposal, developed in accordance with internationally adopted standards, aimed at illustrating an organic and systematic approach to managing data processing risks. The impact of the GDPR on data processing activities for statistical purposes within the National Statistical System requires the acquisition of widespread knowledge and awareness of privacy protection, representing the added value that the “good statistician” brings in safeguarding the rights and fundamental freedoms of data subjects.