PII

PII, or personally identifiable information, is data that can be used to identify a specific person. It can be information about an individual in isolation or data that, when combined with other details, can reveal who someone is. Common examples include names, addresses, phone numbers, email addresses, government identifiers, and account numbers. Indirect identifiers, such as dates of birth, IP addresses, or employment history, may also identify someone when correlated with other data.

PII is often categorized as direct or indirect identifiers. Direct identifiers make a person identifiable on their own, while indirect identifiers require additional information to establish identity. Some data are considered sensitive PII in many jurisdictions, including biometric data, genetic information, medical records, and certain financial data, where misuse may pose greater risk to individuals.

Legal and regulatory contexts vary by country and region. Frameworks such as the European Union’s General Data Protection Regulation, the California Consumer Privacy Act, the Health Insurance Portability and Accountability Act in the United States, and similar laws elsewhere define what counts as PII, related rights, and obligations for organizations. The boundaries and protections for PII often depend on the data type, context, and the purpose of processing.

Handling PII typically involves data minimization, access controls, encryption, pseudonymization, and clear retention limits. Organizations should assess risks, implement incident response procedures, and provide privacy training. When sharing or transferring PII across borders, contracts and cross-border transfer mechanisms are usually required to protect individuals’ privacy.