Personally Identifiable Information (PII)

Personally identifiable information is any data that can identify a specific person, on its own or combined with other data you hold. A Social Security number does it directly. A ZIP code, a birth date, and a job title can do it together. PII is the general term. HIPAA's protected health information and the CCPA's personal information are separate legal definitions with their own boundaries, and they don't line up neatly with PII or with each other.

What counts as PII?

The most widely used definition comes from NIST Special Publication 800-122, published in April 2010 and unrevised since. Section 2.1 describes PII as "any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information." NIST adopted the wording from GAO report GAO-08-536.

Read the scope before you borrow the definition. SP 800-122 is a federal agency guideline, and its text says "maintained by an agency." Lifting it as a general corporate definition is a slight misuse, which is why careful privacy teams cite it as the most widely used definition rather than the definition.

The practical split is between two kinds of identifiers:

• Direct identifiers name the person by themselves. Full name, Social Security number, passport or driver's license number, email address, employee ID, biometric records.
• Indirect identifiers identify by combination. ZIP code, birth date, gender, job title, IP address, device identifier, browsing history. Any one of these is ambiguous. Two or three together often are not.

That second category is where most privacy incidents start, because the data feels harmless at collection time. A spreadsheet of "anonymized" survey results with department, tenure, and location columns can re-identify a team of four without ever carrying a name.

PII vs. PHI vs. personal information

These three get used as synonyms and they are not. Each has a different scope test.

Two consequences matter for a compliance program.

First, HIPAA is entity-scoped. Its standards apply to health plans, health care clearinghouses, health care providers who transmit health information electronically in connection with a covered transaction, and, where provided, business associates (45 CFR 164.104). A wellness vendor's data set can carry identical fields and sit outside that list entirely. See PHI for where those boundaries fall.

Second, CCPA personal information is broader than PII in a way that surprises people. It reaches households rather than only individuals, and its "reasonably capable of being associated with" standard sweeps in IP addresses, device identifiers, geolocation, browsing history, and inferences drawn from any of them.

What is sensitive personal information?

California defines "sensitive personal information" separately from personal information, at Cal. Civ. Code 1798.140(ae). The category covers things like Social Security and other government ID numbers, financial account credentials, precise geolocation, genetic and biometric data, and the contents of mail, email, and text messages. Treat it as a distinct handling tier in your data map rather than folding it into a general PII bucket, because the systems that hold it usually need tighter access control than the ones that hold a mailing list.

How does PII get exposed at work?

Very little PII leaves a company through a sophisticated attack. It leaves through routine work:

1. Email autocomplete. A payroll file goes to the wrong Sarah.
2. Over-collection. A form asks for a full SSN when the last four digits would do, and now the full number sits in a ticketing system forever.
3. Shadow copies. Someone exports a CRM segment to a personal spreadsheet for a one-time analysis and never deletes it.
4. Third-party tools. Employees paste customer records into an unapproved AI tool or transcription service.
5. Credential phishing. An attacker reaches a mailbox or a SaaS account and reads whatever that account can reach. See phishing.
6. Unrevoked access. A departed employee's account, or a current employee whose access never narrowed after a role change.

Each of these is a behavior problem with a control attached, which is why PII handling belongs in recurring training rather than only in a policy document.

How should employees handle PII?

Four rules cover most day-to-day decisions, and they are worth stating in exactly these terms:

• Collect the minimum. Ask what the field is for. If nobody can name a use, drop it.
• Keep it where it belongs. Approved systems only. No personal drives, no personal devices, no unapproved AI tools.
• Share on a need-to-know basis. Check the recipient before sending, and send a link with permissions rather than an attachment when the system allows it.
• Report fast. A misdirected email reported in ten minutes is often recoverable. The same email reported in a week is a notification event.

Your acceptable use policy is where these rules become enforceable, and where the AI-tool question gets a specific answer rather than a shrug.

FAQ

Is a work email address PII?

Usually yes. A name-based work address distinguishes a specific individual, which puts it inside the NIST framing. Generic aliases like info@ do not identify anyone.

Is an IP address PII?

It depends on the regime. Under the CCPA, an IP address is personal information when it is reasonably capable of being associated with a consumer or household. US federal practice treats it as an indirect identifier whose status depends on what else you hold.

Does deidentified data stop being regulated?

Under the CCPA, deidentified and aggregate consumer information sits outside the definition of personal information. That exclusion depends on the data genuinely resisting re-identification, so treat weakly deidentified data as still in scope.