# Cross-Jurisdiction Classification Mapping Record

## Organisation: Vanguard Financial Services
## Reference: XJUR-MAP-2026-001
## Date: 2026-03-14
## Prepared By: Legal & Compliance Team
## Reviewed By: Dr. James Whitfield, DPO

---

## Data Element: Employee Health Records (Occupational Health Assessments)

| Jurisdiction | Applicable Law | Classification | Category | Processing Condition |
|-------------|---------------|---------------|----------|---------------------|
| UK GDPR | Art. 9(1) | Special category | Health data (Recital 35) | Art. 9(2)(h) — Occupational medicine under health professional |
| CCPA/CPRA | §1798.140(ae)(2) | Sensitive PI | Health information | Right to limit use §1798.121 (CA employees) |
| HIPAA | 45 CFR §160.103 | PHI | Individually identifiable health information | Minimum necessary §164.502(b); applicable if shared with US covered entity |
| LGPD | Art. 5-II | Sensitive personal data | Health data | Art. 11(II)(f) — Exercise of rights in labour proceedings |

**Unified Tier**: RESTRICTED

**Handling**: Most restrictive standard applies — Art. 9(2)(h) occupational medicine condition with professional secrecy; HIPAA minimum necessary if shared with US healthcare partners; CCPA opt-out honoured for California employees; LGPD specific consent or legal basis for Brazilian employees.

---

*Mapping maintained per Vanguard Cross-Jurisdiction Classification Standard XJCS-2025-v2.0. Updated when regulatory changes affect any applicable jurisdiction.*