FieldRegister
Every field · Identifiers

Government identifier (passport, national ID, SSN, tax number)

Government identifiers are high-risk identifiers; CPRA treats them as sensitive PI. They enable identity fraud if leaked.

personal data
personal data?
confidential
sensitivity
never
AI use
legal obligation, or contract where identity must be verified
lawful basis usually relied on

Keep it how long

Only for the verification or statutory purpose; retention set by the law that requires it.

The gap we see most

Stored in a plain text field for a one-off verification and never deleted.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Government identifiers stored GDPR Art.32 · CCPA/CPRA §1798.121 · CCPA/CPRA §1798.100(e) · ISO/IEC 27701:2019 7.4.9
GDPR Art.32 Security of processing

Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk of varying likelihood and severity for the rig...

Evidence an auditor accepts: The security risk assessment per processing activity, expressed as risk to the rights and freedoms of individuals rather than only as risk to the organisation; Encryption and pseudonymisation coverage at rest, in transit and in backup, with the decision recorded where either was judged not appropriate; Restoration testing results showing personal data was actually recovered inside the intended timeframe, with the date and outcome
CCPA/CPRA §1798.121 Honour the right to limit use of sensitive personal information

A business using or disclosing sensitive data beyond what an average consumer expects for the requested goods or services, or the other purposes the regulations allow (11 CCR 7027(m)), must tell consumers so and let them limit use to those purposes. After a request to limit, the business may use the...

Evidence an auditor accepts: Register of sensitive personal information uses mapped to the permitted purposes; Limit-request preference store and enforcement in downstream systems; Analysis of whether sensitive data is processed to infer characteristics
CCPA/CPRA §1798.100(e) Maintain reasonable security for personal information

A business that collects personal information must run security procedures and practices suited to the nature of the data, so that it is not accessed, destroyed, used, altered or disclosed without authority or unlawfully, as section 1798.81.5 requires. A breach of nonencrypted or nonredacted data ca...

Evidence an auditor accepts: Written information security policy and risk assessment covering systems that hold personal information; Encryption and redaction standards with evidence of coverage for stored and transmitted personal information; Access control reviews, vulnerability management records and penetration test reports
ISO/IEC 27701:2019 7.4.9 PII transmission controls

The organization must subject personal data transmitted over a data transmission network to controls designed to ensure it reaches its intended destination, typically by ensuring only authorized individuals have access to transmission systems and by following processes, including retaining audit log...

Evidence an auditor accepts: Documented transmission controls covering authorisation, protection and recipient verification; Access controls over transmission systems; Audit logs of transmissions retained and reviewable

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Criminal convictions or offences · Payment card or bank account details