OpenPIIMap: Mapping Sensitive Data Definitions Globally

Understand and track PII/PHI across jurisdictions like GDPR, HIPAA, and more.

Structured, machine-readable definitions of PII and PHI across countries — accessible to both developers and compliance teams.

Every YAML file corresponds to a specific jurisdiction (e.g. Germany under GDPR) with citations and tags.

Definitions use a structured schema with `type`, `required_masking`, `citations`, and category tags.

All definitions are public, version-controlled, and easy to contribute. Pull requests and issues welcome!

Privacy laws vary by region. OpenPIIMap brings consistency, clarity, and automation to sensitive data handling across borders.

Know exactly what qualifies as PII or PHI in each country and law.

Harmonize privacy logic across GDPR, HIPAA, CPRA, and more.

Use YAML definitions in your anonymizers, validators, or ML workflows.

Built and maintained by privacy engineers, legal experts, and open-source contributors.

GDPR – Europe

Defines personal data as any information relating to an identified or identifiable person. Includes strict rules for consent, access, and erasure.

HIPAA – United States

Focuses on protecting health data (PHI). Defines 18 identifiers and mandates anonymization or expert determination for compliance.

CPRA – California

Expands CCPA by defining sensitive personal information (SPI), adding rights to limit data use, and requiring data minimization.

DPDPB – India

India’s new Digital Personal Data Protection Bill introduces consent-based processing, cross-border controls, and privacy-by-design principles.

LGPD – Brazil

Defines personal data broadly and includes legal bases for processing, data subject rights, and national enforcement authority (ANPD).

PIPEDA – Canada

Applies to private-sector organizations. Requires meaningful consent and safeguards for identifiable information in commercial activity.