FieldRegister
Every field · Special category and never-store data

Racial or ethnic origin

Racial or ethnic origin is a special category (Art. 9) and sensitive PI under CPRA.

personal data
personal data?
special
sensitivity
never
AI use
explicit consent, or an equality-monitoring exemption in law
lawful basis usually relied on

Keep it how long

Only for the specific statutory purpose.

The gap we see most

Collected for diversity reporting and then kept on the contact record indefinitely.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Special category data in the CRM GDPR Art.9 · CCPA/CPRA §1798.121 · CCPA/CPRA CCR 7027 · ISO/IEC 27701:2019 7.2.2 · ISO/IEC 27701:2019 7.4.1
GDPR Art.9 Processing of special categories of personal data

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orienta...

Evidence an auditor accepts: An inventory identifying where special category data is held, including where it is inferred rather than collected; The Article 9(2) condition recorded per activity alongside its separate Article 6 basis; The Union or Member State law relied on where the condition requires one, cited to the provision
CCPA/CPRA §1798.121 Honour the right to limit use of sensitive personal information

A business using or disclosing sensitive data beyond what an average consumer expects for the requested goods or services, or the other purposes the regulations allow (11 CCR 7027(m)), must tell consumers so and let them limit use to those purposes. After a request to limit, the business may use the...

Evidence an auditor accepts: Register of sensitive personal information uses mapped to the permitted purposes; Limit-request preference store and enforcement in downstream systems; Analysis of whether sensitive data is processed to infer characteristics
CCPA/CPRA CCR 7027 Handle requests to limit use of sensitive personal information

A business using sensitive data beyond the purposes listed in subsection (m) must offer two or more easy methods to limit, require no account or verification, stop the additional use and disclosure as soon as feasible and within 15 business days, instruct service providers and contractors using the ...

Evidence an auditor accepts: Limit request log and evidence of the 15-business-day stop; Mapping of sensitive data uses to the subsection (m) purposes; Instructions sent to recipients of sensitive data after a limit request
ISO/IEC 27701:2019 7.2.2 Identify lawful basis

The organization must determine, document and comply with the lawful basis for each processing activity against its identified purposes, documenting the basis per activity, including any special categories of personal data in its classification scheme with awareness that the classification and its c...

Evidence an auditor accepts: Lawful basis recorded against each processing activity, with the reasoning; Where legitimate interests is relied on, the balancing against obligations to individuals; Classification scheme entries covering special categories, mapped to the jurisdictions that define them
ISO/IEC 27701:2019 7.4.1 Limit collection

The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and necessary for the identified purposes, including data collected indirectly through means such as web and system logs, and where any optionality in collection and processing exists each...

Evidence an auditor accepts: Field level justification linking each item collected to an identified purpose; Assessment of indirectly collected data such as logs, telemetry and tracking; Evidence optional collection is off by default, captured from the live configuration

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Biometric or genetic data · Religious or philosophical belief