There are different sanctions lists and watch lists all over the world maintained by governments & ministries, like well-known ones: OFAC lists, EU Consolidated Sanctions, CIA & FBI watch lists and many more. They often contain quite a lot of personal information about name variations, addresses, DOBs etc. which is usually considered as PII (as soon as it allows identifying a person) and should fall into a regulation of GDPR and similar. However, this data is openly accessed and even aggregated by projects like OpenSanctions.
So here's the question -- is it a special exceptional case that data privacy rules do not apply to sanctioned person data, or is it a worldwide violation of data privacy rules (very unlikely)? In a former case, who is authorised to decide that this person's data can be accessed without a restriction?
A more practical question would be, if let's say I want to collect some data about disqualified directors in the UK (https://beta.companieshouse.gov.uk) or another country, should I apply technical measures in line with the regulation (GRPR for instance) to protect this data in my system (e.g. encrypt it at rest)?
Please advise if it's an off-topic & I should move this question to another hub.