Personally identifiable information (PII) is any data that can identify a specific person, either on its own – such as a name or passport number – or combined with other information.
What counts as PII
NIST Special Publication 800-122 defines PII as information that can be used to distinguish or trace an individual’s identity, alone or when linked with other data. It is often divided into two groups:
- Direct identifiers – full name, national ID or Social Security number, passport and driver’s licence numbers, biometric data, personal email addresses and phone numbers.
- Indirect (quasi-) identifiers – date of birth, postcode, gender, job title, IP address or device identifiers that can identify someone when combined.
Sensitive PII, such as financial account numbers, medical records or ID numbers, causes particular harm if exposed. European law uses the broader concept of “personal data” under the GDPR.
Why PII matters for security
PII is one of the main goals of data breaches because it can be sold and reused. Criminals use it for identity theft, opening loans in victims’ names, convincing phishing and SIM swapping, while activists and stalkers use it for doxing. Large incidents show the scale: the 2017 Equifax breach exposed names, Social Security numbers and birth dates of about 147 million people. Organisations that leak PII face regulatory fines, lawsuits and mandatory breach notifications.
How to protect PII
- Collect only the PII that is truly needed and delete it when no longer required.
- Encrypt PII at rest and in transit and restrict access on a need-to-know basis.
- Use data loss prevention to detect PII leaving the organisation.
- Pseudonymise or anonymise data used for testing and analytics.
- Individuals should limit what they share online and monitor credit reports.
