Meridian Risk levels
1. Asset is listed in Privacy Shield.
2. Asset is managed by government.
3. Asset processes non-sensitive data
4. Not listed in Privacy Shield, not ran by government, and asset processes sensitive data,
Other notes:
Privacy shield - Data Privacy Framework
Also, assets with HIPPA certification are also considered Level 1.
Knowledge Base Article on Sensitive and Non-sensitive examples - Personal Data Categories : Knowledge Base (freshdesk.com)