Thresholds
Non-CIIO processors: under 100,000 non-sensitive individuals can be exempt from security assessment/SCC/certification; 100k–<1m ordinary or <10k sensitive generally uses SCC/certification; ≥1m ordinary or ≥10k sensitive triggers security assessment. Important data and CIIO rules override.