Personal Identifiable Information (PII) refers to any data that can identify a specific individual either alone or in combination with other information. This includes direct identifiers like names, Social Security numbers, and email addresses, as well as indirect identifiers such as birth dates, gender, and zip codes when linked to a person.
Under U.S. federal regulations, PII is defined by the National Institute of Standards and Technology (NIST) as "any information that can be used to distinguish or trace an individual's identity." This definition applies across sectors, including healthcare, finance, education, and tech. The Privacy Act of 1974 and the Health Insurance Portability and Accountability Act (HIPAA) further specify which data qualifies as PII in regulated environments.
Not all personal data counts as PII. For example, a person's job title or general location (e.g., "New York City") is not PII unless combined with other data that enables identification. The key factor is whether the data allows someone to pinpoint a unique individual.
PII falls into two categories: direct and indirect. Direct PII includes data that uniquely identifies a person without needing additional context. Examples include:
Indirect PII requires correlation with other data to identify someone. A single piece like a date of birth or ZIP code is not PII on its own. But when combined-say, a 35-year-old living in ZIP code 90210-the risk of re-identification increases. NIST defines this as "linked PII," where the combination creates a high likelihood of identifying an individual.
Some data is treated as sensitive PII due to higher risk of harm if exposed. Sensitive PII includes:
For example, a hospital system storing patient names, medical diagnoses, and treatment dates holds both PII and Protected Health Information (PHI), which is a subset of PII governed by HIPAA. PHI includes any health data that can be linked to an individual.
Consider a retail company collecting customer data through an online checkout. The following entries are classified as PII:
A 2021 study by the Identity Theft Resource Center found that 81% of data breaches involved PII exposure. In one case, a fitness app leaked users' names, workout logs, and GPS locations. While GPS coordinates alone aren't PII, when matched with names and timestamps, they revealed users' home locations and routines-enabling stalking risks.
Another example: a university student portal displaying grades and student IDs. The student ID is direct PII. If the portal also shows the student's major, year of enrollment, and hometown, the dataset becomes highly re-identifiable. Even anonymized datasets can leak identity when cross-referenced with public records.
Not all personal data qualifies as PII. Data that cannot reasonably identify an individual-even if it relates to a person-is excluded. Examples include:
Even when data appears personal, it may not be PII if it lacks linkage. For instance, a list of usernames from a forum is not PII unless those usernames are associated with real names, emails, or IP addresses.
A common misconception is that all data collected during user signups is PII. In reality, fields like "preferred color" or "favorite movie" are not PII unless tied to a known identity. However, if a user signs up using their real name and email, then the entire profile becomes PII.
PII differs from non-PII, anonymized data, and pseudonymized data. Anonymized data removes all identifiers so that re-identification is impossible. Pseudonymized data replaces identifiers with artificial keys-for example, replacing "Sarah Johnson" with "User_456"-but retains the ability to re-link if the mapping file is accessed.
Under the General Data Protection Regulation (GDPR), EU law treats PII as "personal data" and mandates strict handling. The U.S. lacks a single federal law, but sector-specific rules apply. HIPAA covers healthcare PII, GLBA governs financial data, and COPPA regulates children's data. State laws like the California Consumer Privacy Act (CCPA) also define PII broadly.
One non-obvious point: location data is PII only when precise enough to identify a person. A city-level location (e.g., "Denver") is not PII. But a GPS coordinate accurate to within 10 meters-especially when timestamped and correlated with a device ID-is PII under NIST guidelines.
I once audited a mobile app that tracked users' daily routes. The raw data included latitude/longitude pairs and timestamps. Initially labeled "anonymous," the dataset was re-identifiable when cross-referenced with public transit schedules and known user behavior patterns. After correcting the classification, we applied encryption and access controls to meet compliance standards.
| Type | Examples | PII Status | Notes |
|---|---|---|---|
| Direct PII | Full name, SSN, passport number | Yes | Identifies person without external data |
| Indirect PII | Date of birth + ZIP code | Yes (if combined) | High re-identification risk |
| Sensitive PII | Credit card, biometrics, health records | Yes | Higher regulatory scrutiny |
| Non-PII | Job title, general location, favorite color | No | Cannot identify a specific person |
Understanding what data is considered PII ensures compliance with privacy laws and reduces breach risk. Organizations must assess each data element based on context, linkage potential, and jurisdictional rules.
When managing data, ask: Can this be linked to a real person? Does it allow identification without external tools? If yes, treat it as PII. If no, it may still require protection-but not under PII-specific regulations.
What data is considered PII depends on context, linkage, and legal structure-not just the form of the data itself.