# Standards and Regulatory References — Cross-Jurisdiction Classification

## GDPR — Regulation (EU) 2016/679

- **Article 9**: Special categories of personal data — eight categories with general prohibition and ten exceptions.
- **Article 3**: Territorial scope — applies to processing of personal data of EU data subjects regardless of controller location.

## CCPA/CPRA — California Consumer Privacy Act (as amended)

- **Cal. Civ. Code §1798.140(ae)**: Definition of sensitive personal information — 12 categories including government IDs, financial credentials, precise geolocation, communications content, and demographic categories aligning with GDPR special categories.
- **Cal. Civ. Code §1798.121**: Right to limit use and disclosure of sensitive PI — consumers may direct businesses to limit use to purposes necessary for providing requested goods or services.
- **Cal. Civ. Code §1798.140(v)**: Definition of personal information — information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household.
- **11 CCR §7027**: CPRA regulations on sensitive personal information — specifies notice requirements and opt-out mechanisms.

## HIPAA — Health Insurance Portability and Accountability Act (United States)

- **45 CFR §160.103**: Definition of protected health information (PHI) — individually identifiable health information held or transmitted by a covered entity or business associate.
- **45 CFR §164.514(b)**: De-identification standard — 18 identifiers that must be removed for data to be considered de-identified (Safe Harbor method).
- **45 CFR §164.514(a)**: Expert determination method — a qualified statistical expert determines that re-identification risk is very small.
- **45 CFR §164.502(b)**: Minimum necessary standard — covered entities must make reasonable efforts to use, disclose, and request only the minimum amount of PHI needed.

## LGPD — Lei Geral de Proteção de Dados (Brazil)

- **Art. 5-I**: Definition of personal data — information related to an identified or identifiable natural person.
- **Art. 5-II**: Definition of sensitive personal data — data on racial or ethnic origin, religious belief, political opinion, trade union or organisational membership, health, sex life, genetic data, biometric data.
- **Art. 11**: Processing of sensitive personal data — consent must be specific and highlighted; alternative bases include regulatory compliance, research, health protection, fraud prevention.
- **Art. 14**: Processing of children's and adolescents' personal data — requires specific and prominent consent from parent or legal guardian.

## Other US State Laws

### Virginia Consumer Data Protection Act (VCDPA)

- **Va. Code §59.1-575**: Definition of sensitive data — racial/ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, citizenship/immigration status, genetic/biometric data, children's data, precise geolocation.
- **Processing standard**: Consent required before processing sensitive data.

### Colorado Privacy Act (CPA)

- **C.R.S. §6-1-1303(24)**: Sensitive data definition — racial/ethnic origin, religious beliefs, mental/physical health condition, sex life/sexual orientation, citizenship/immigration status, genetic/biometric data, children's data.

### Connecticut Data Privacy Act (CTDPA)

- **Conn. Gen. Stat. §42-515(27)**: Sensitive data — substantially mirrors VCDPA definition.

## International Standards

### ISO/IEC 27701:2019 — PIMS Extension

- **Clause 7.2.8**: PII inventory requirements apply globally; classification must accommodate multiple jurisdictional requirements.
- **Annex D**: Mapping to GDPR requirements.
- **Annex F**: Mapping to ISO/IEC 29100 privacy principles (jurisdiction-neutral).

### APEC Cross-Border Privacy Rules (CBPR)

- **Framework**: Voluntary framework for cross-border data transfer among APEC economies. Classification requirements are principles-based rather than prescriptive.