Can sex life or sexual orientation from a CRM be fed to an AI tool?

No. Keep it out of any model feed.

Every field · Special category and never-store data

Sex life or sexual orientation

Q: Is sex life or sexual orientation personal data?

Personal data. Sex life and sexual orientation are special categories (Art. 9) and sensitive PI under CPRA.

Sex life and sexual orientation are special categories (Art. 9) and sensitive PI under CPRA.

personal data

personal data?

special

sensitivity

never

AI use

explicit consent

lawful basis usually relied on

Keep it how long

Only for the specific purpose.

The gap we see most

Rarely intended in a CRM; usually an inherited field from an imported list.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Special category data in the CRM GDPR Art.9 · CCPA/CPRA §1798.121 · CCPA/CPRA CCR §7027 · ISO/IEC 27701:2019 7.2.2 · ISO/IEC 27701:2019 7.4.1

GDPR Art.9 Processing of special categories of personal data

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, biometric data processed to uniquely identify a person, data concerning health, or data concerning a person's sex life or sexual orienta...

Evidence an auditor accepts: An inventory identifying where special category data is held, including where it is inferred rather than collected; The Article 9(2) condition recorded per activity alongside its separate Article 6 basis; The Union or Member State law relied on where the condition requires one, cited to the provision

CCPA/CPRA §1798.121 Right to Limit Use and Disclosure of Sensitive Personal Information

Consumers have the right to direct a business that collects sensitive PI to limit its use to that necessary to perform services or provide goods reasonably expected by an average consumer, or for specified permitted purposes (security, fraud, short-term transient use, performing services, verifying ...

Evidence an auditor accepts: Sensitive PI inventory (SSN, drivers license, financial, geolocation, race, religion, biometric, health, sexual orientation, contents of communications); Limit Use of My Sensitive Personal Information mechanism (when required); Permitted purpose justification documentation

CCPA/CPRA CCR §7027 Requests to Limit Use of Sensitive PI Handling

Once a consumer requests to limit, the business shall not use or disclose the sensitive PI for any purpose other than those permitted under §1798.121(a). The business shall comply within 15 business days, notify service providers and contractors, and shall not require account creation. The Limit lin...

Evidence an auditor accepts: Limit-request SLA tracking; Service provider and contractor notifications; Combined Your Privacy Choices link compliance with regulation icon

ISO/IEC 27701:2019 7.2.2 Identify lawful basis

The organization must determine, document and comply with the lawful basis for each processing activity against its identified purposes, documenting the basis per activity, including any special categories of personal data in its classification scheme with awareness that the classification and its c...

Evidence an auditor accepts: Lawful basis recorded against each processing activity, with the reasoning; Where legitimate interests is relied on, the balancing against obligations to individuals; Classification scheme entries covering special categories, mapped to the jurisdictions that define them

ISO/IEC 27701:2019 7.4.1 Limit collection

The organization must limit collection of personal data to the minimum that is adequate, relevant, proportional and necessary for the identified purposes, including data collected indirectly through means such as web and system logs, and where any optionality in collection and processing exists each...

Evidence an auditor accepts: Field level justification linking each item collected to an identified purpose; Assessment of indirectly collected data such as logs, telemetry and tracking; Evidence optional collection is off by default, captured from the live configuration

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Political opinion or trade union membership · Criminal convictions or offences