PII (Personally Identifiable Information)

Any piece of information that could be used to identify a specific person, such as a name, date of birth, or government ID number.

On its own, a detail like a birthday may not point to one person, but combined with a name or an address it does.

Data elements that, alone or combined with other available information, are capable of identifying a specific natural person, triggering heightened handling and disclosure obligations under most privacy laws. A natural person is a real individual, as opposed to a company.

PII is often described in two groups:

• Direct identifiers, which point to a person by themselves, such as a name, a government ID number, a passport number, or a face image.
• Indirect identifiers, which identify someone only in combination, such as a birth date, a postal code, and a job title.

Common examples include:

1. Names and contact details, such as an email address, a phone number, and a home address.
2. Government identifiers, such as a social security number or a driver's license number.
3. Biometric data, such as a face template or a fingerprint.
4. Online identifiers, such as device identifiers and IP addresses, which many laws also treat as personal information.

Terminology varies by law. The US uses PII widely, while the EU's GDPR uses the broader term personal data, and California's CCPA uses personal information.

PII sits next to terms that are easy to mix up:

• GDPR is the EU law that protects personal data.
• CCPA/CPRA is California's law that protects personal information.
• Data minimization limits how much PII is collected in the first place.