What Is PII? Personally Identifiable Information Explained
Many teams think PII means only Social Security numbers and bank details. So what is PII? It is any information that can identify a specific person, on its own or combined with other data. That includes names, email addresses and device IDs. Get the scope wrong and your breach plan protects the wrong files.
What Is PII?
PII, short for personally identifiable information, is any data that can be used to distinguish or trace a person’s identity, either directly or when linked with other information. Common examples include:
- Full name and home address
- Social Security number (SSN), passport or driver’s license number
- Email address and phone number
- Biometric records such as fingerprints
- Financial account and card numbers
What Does PII Stand For? (PII Full Form)
PII stands for personally identifiable information. The term is mainly American. It comes from US federal privacy guidance, and US laws, contracts and audits use it most.
How NIST Defines PII
The National Institute of Standards and Technology (NIST) set the reference definition in SP 800-122 (2010). PII is any information that can distinguish or trace an individual’s identity, such as name, SSN, date and place of birth, mother’s maiden name or biometric records. It also covers any other information linked or linkable to that person, such as medical, educational, financial and employment details. The “linkable” part is what most people miss.
PII vs Personal Data vs PHI: The Comparison That Sets Your Scope
Before you can protect PII, you need to know which rulebook applies. The same customer record can be PII in a US contract, personal data under the UK GDPR and protected health information (PHI) under HIPAA.
| PII | Personal data | PHI | |
|---|---|---|---|
| Main source | NIST SP 800-122, OMB guidance, US state laws | GDPR and UK GDPR, Article 4(1) | HIPAA Privacy Rule |
| Region | US | UK and EU | US healthcare |
| Scope | Data that identifies or can be linked to a person | Any information relating to an identified or identifiable living person | Health information held by covered entities and business associates that identifies a patient |
| Online identifiers | Depends on the law and context | Expressly included (IP addresses, cookie IDs can qualify) | Included when linked to health data |
| Breadth | Narrower | Widest | Narrowest, sector-specific |
PII in the US vs Personal Data Under GDPR and UK GDPR
The GDPR and UK GDPR define personal data as any information relating to an identified or identifiable natural person, and they name online identifiers in the definition. That makes “personal data” wider than most US uses of PII. Article 9 adds “special category data,” such as health, biometric data used for identification, racial or ethnic origin, religious beliefs and sexual orientation, which needs extra conditions to process.
A practical decision rule follows. If you hold data on UK or EU residents, scope your program to the GDPR definition. It covers everything US PII covers and more, so one inventory then works for both regions.
How PII Differs From PHI Under HIPAA
PHI is health information that identifies a person and is created or held by a HIPAA covered entity (such as a clinic or health plan) or its business associate. A patient’s name is PII. That same name next to a diagnosis in a clinic’s system is PHI. The HIPAA de-identification “Safe Harbor” method lists 18 identifiers that must be removed before health data stops counting as PHI.
What Is Considered PII?
PII falls into two groups, and the second is where scope mistakes happen.
Direct Identifiers
Direct identifiers point to one person on their own: full name, SSN, passport number, driver’s license number, biometric records and a personal email address.
Indirect (Linkable) Identifiers
Indirect identifiers do not name a person alone, but they narrow the field: date of birth, ZIP or postal code, gender, job title, employer, IP address and device IDs.
When Combined Data Becomes PII
Small facts add up. Research by Latanya Sweeney at Carnegie Mellon University (2000) estimated that 87% of the US population could be uniquely identified by just ZIP code, gender and date of birth. That is why a spreadsheet with no names can still be PII. Treat any dataset that combines three or more indirect identifiers as PII by default.
Sensitive vs Non-Sensitive PII
Sensitive PII is data whose exposure could cause serious harm, such as identity theft, fraud or discrimination. Non-sensitive PII is often public or low impact on its own. NIST SP 800-122 recommends setting a “PII confidentiality impact level” of low, moderate or high based on factors like how identifiable the data is, how many records exist and how sensitive the fields are.
PII Data Examples
Sensitive PII Examples (SSN, Passport, Biometrics, Financial Data)
- Social Security, passport and driver’s license numbers
- Fingerprints, face scans and other biometric data
- Bank account and payment card numbers
- Medical records and health insurance details
- Login credentials
Non-Sensitive PII Examples (Name, Work Email, ZIP Code)
- Name and work email address
- Business phone number and job title
- ZIP or postal code
- Gender and race (sensitive under UK GDPR special categories)
Edge Cases: Are Email Addresses, IP Addresses and Cookies PII?
An email address is PII when it identifies a person, and a personal address almost always does. A shared inbox like “sales@” usually does not. IP addresses and cookie IDs are named as online identifiers that can be personal data under GDPR and UK GDPR. In the US, the answer depends on the law. For example, the California Consumer Privacy Act (CCPA) lists IP addresses and other online identifiers in its definition of personal information.
What Is Not PII?
Data is not PII when it cannot reasonably be linked back to a person. Examples include properly aggregated statistics, truly anonymized data and information about a company rather than an individual. Be careful with “anonymized.” The ICO notes that pseudonymized data, where identifiers are swapped for codes but a key exists, is still personal data under the UK GDPR.
What Is PII in Cyber Security?
In cyber security, PII is a core asset to find, classify and protect, because it is what attackers most often take.
Why Attackers Target PII
PII sells. It feeds identity theft, account takeover, tax fraud and targeted phishing. IBM’s Cost of a Data Breach Report 2025 found customer PII was compromised in 53% of breaches, the most common data type, at an average of $160 per record.
How PII Is Stolen
- Phishing: staff hand over logins to systems that hold PII.
- Breaches: attackers exploit unpatched systems or stolen credentials.
- Insider misuse: employees copy or misuse records they can access.
- Misconfigured cloud storage: a public storage bucket or shared link exposes files to anyone.
PII Laws and Regulations in the US and UK
US: FTC Act, CCPA/CPRA, HIPAA, GLBA and State Breach Laws
The US has no single federal privacy law. The Federal Trade Commission (FTC) uses Section 5 of the FTC Act against unfair or deceptive data practices. HIPAA covers health data, the Gramm-Leach-Bliley Act (GLBA) covers financial institutions and COPPA covers children under 13 online. California’s CCPA, as amended by the CPRA, gives residents rights over their personal information. State breach notification laws set their own triggers and deadlines.
UK and EU: UK GDPR, Data Protection Act 2018 and the ICO
In the UK, the UK GDPR and the Data Protection Act 2018 govern personal data, and the Information Commissioner’s Office (ICO) enforces them. Serious breaches of the rules can draw fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. Reportable breaches must go to the ICO within 72 hours of discovery. Obligations vary by sector and data type, so confirm with counsel.
Who Is Responsible for Protecting PII?
The organization that collects PII is responsible for it. Under GDPR terms, that is the controller, which must also make sure any processor (such as a payroll or cloud provider) protects it under a written contract. Inside the business, leadership owns the risk, IT and security run the controls and every employee who handles PII must follow the rules. Outsourcing a system does not outsource accountability.
How Is PII Protected? 8 Best Practices for Businesses
Discover and Classify PII
You cannot protect data you have not found. Scan file shares, email, cloud storage and databases, then label records by sensitivity.
Minimize Collection and Retention
Collect only what you need and delete it on a set schedule. The GDPR calls this data minimization and storage limitation.
Encrypt PII at Rest and in Transit
Encrypt laptops, databases and backups, and use TLS for data moving across networks.
Enforce Least-Privilege Access and MFA
Give staff access only to the PII their role needs, and require multifactor authentication (MFA) for every system that stores it.
Use DLP to Stop PII Leaks
Data loss prevention (DLP) tools spot patterns such as SSNs or card numbers in email and uploads, then block or warn.
Anonymize or Pseudonymize Where Possible
Use masked or tokenized data for testing and analytics, so a leak exposes codes instead of identities.
Train Staff to Handle PII
Teach people what counts as PII, how to share it safely and how to report a mistake quickly.
Have a Breach Response Plan
Write down who decides, who notifies regulators and customers and which deadlines apply in each region.
What to Do If PII Is Exposed
- Contain it: revoke shared links, reset compromised passwords and isolate affected systems.
- Assess what data was exposed, how many people are affected and whether it was encrypted.
- Notify as required: the ICO within 72 hours for reportable UK breaches, and regulators and individuals under the relevant US state and federal laws.
- Support affected people, for example by telling them which accounts to secure.
- Fix the root cause and record the lessons.
Your PII Protection Starting Checklist
What is PII for your business? It is every record that can point to a person, including the ones with no names. Work through this list this quarter:
- Inventory where PII lives, using the GDPR definition if you serve UK or EU customers
- Mark sensitive PII and set an impact level for each dataset
- Turn on MFA and encryption for every system that stores it
- Delete data you no longer need
Cyber Security Solutions Ltd offers a free, no-obligation data security assessment if you want help with the first step, and you can request it through our contact page.
FAQs
A name is usually considered PII, because it identifies a person directly. A very common name on its own may be hard to tie to one individual, but it becomes clearly identifying when combined with an address, employer or date of birth. Most businesses should treat names as PII and protect them accordingly.
Yes. A date of birth is an indirect identifier and counts as PII, especially when combined with other details. Carnegie Mellon research from 2000 estimated that ZIP code, gender and date of birth together could uniquely identify 87% of Americans. Treat dates of birth as PII and limit who can see them.
No. PHI is a narrower category defined by HIPAA: health information that identifies a person and is held by a covered entity or business associate. All PHI contains PII, but most PII is not PHI. A customer email list is PII. A clinic's patient list with diagnoses is PHI.
A PII violation happens when personal information is collected, used, shared or protected in a way that breaks a law, contract or policy. Examples include emailing unencrypted SSNs, storing records longer than allowed, or a breach caused by missing controls. Penalties depend on the law involved, such as HIPAA, state laws or the UK GDPR.
Yes, with the right controls. Use email encryption such as S/MIME or a secure portal for sensitive PII, confirm the recipient's address before sending and send only the minimum data needed. Avoid putting SSNs or card numbers in a subject line or unencrypted attachment. DLP rules can catch mistakes before the message leaves.
It can be. Under the GDPR and UK GDPR, IP addresses are online identifiers that can count as personal data when they can be linked to a person. In the US, it depends on the law. California's CCPA includes IP addresses in its definition of personal information. Treat them as personal data when in doubt.
