Methods, computer-readable media, software, systems and apparatuses may retrieve, via a computing device and over a network, information related to one or more characteristics of a particular application or service deployed in a computing environment. The particular application or service may be associated with a class of applications or services based on the information. A type of personal data collected may be determined for each application or service in the associated class. For the particular application or service, a risk metric indicative of a type of personal data collected by the particular application or service in relation to the type of personal data collected by other applications or services in the associated class may be determined. An additional application or service with a lower risk than the particular application or service may be recommended.