Within the Common Service Data Model (CSDM), regulatory, security, and compliance-related information--especially for PII and PCI--must be modeled at the business and information level, not at the infrastructure or service offering level. The correct location for this data is Business Applications combined with Information Objects.
Business Applications represent the logical applications that support business capabilities and processes. Since compliance obligations (such as GDPR, PCI-DSS, or HIPAA) are assessed based on how the business uses data--not how many servers host the application--this is the correct anchor point for audit-relevant context.
Information Objects are explicitly designed to capture what data is processed, stored, or transmitted by an application, including data classifications such as PII, PCI, PHI, or confidential business data. They allow organizations to document regulatory scope, retention rules, encryption requirements, and audit controls without overloading CI records or polluting infrastructure classes.