Glossary

Data terms

45 data terms in plain words, and the guides where they matter.

• Aggregate data Aggregate data is information combined from many people or records into totals, averages or groups, so it describes a population rather than any single person, such as 'about 40% of customers are under 30'.
• Aggregated data Aggregated data is information combined from many individual records into totals, averages or counts, so it describes a group instead of a single person.
• Anthropometric data Anthropometric data is information about the measurements of a person's body, such as height, weight, or limb and head size. Linked to a named person, it is personal data.
• Baseline data Baseline data is the starting reference you measure change against. In security, NIST uses a baseline to mean a predefined set of controls that serves as a starting point for protecting a system.
• Biometric data Biometric data is information about a person's body or behavior, such as a fingerprint, face or voice, that can be used to recognize or identify them automatically.
• Browsing data Browsing data is the information your browser and the sites you visit record about your activity online, such as pages visited, search terms, cookies, saved form entries and your IP address.
• Cached data Cached data is a temporary copy of web pages, images and other files that your browser or app saves on your device so the next visit loads faster.
• Credit card ZIP code A credit card ZIP code (postal code outside the US) is the postal code of the billing address linked to your card account. Merchants ask for it to help confirm you are the cardholder.
• Data aggregation Data aggregation is compiling data from one or many sources into a single combined view, which can reveal things that no single piece of data shows on its own.
• Data anonymization Data anonymization is the process of removing the link between a set of data and the person it describes, so the data can no longer be tied back to that individual.
• Data asset A data asset is any entity made up of data, such as a database, a document, an output file or a web page. NIST's glossary also counts a service that returns data from an application.
• Data breach A data breach is an incident where personal or other sensitive information is accessed, disclosed or taken by someone who shouldn't have it, whether through an attack or by accident.
• Data broker A data broker is a company that collects personal information about people from many sources and sells or licenses it to others, even though those people never dealt with the company directly.
• Data collector A data collector is any website, app, advertiser or company that gathers information about you, such as what you browse, where you are and what you buy, and stores or uses it.
• Data governance Data governance is a set of processes that ensures an organization's data assets are formally managed, with clear authority and rules for who can make decisions about the data it produces or manages.
• Data leak A data leak is when personal or sensitive information ends up somewhere it shouldn't be, such as an open server, a misdirected email or a shared file, often by mistake rather than because someone broke in.
• Data leakage Data leakage is when personal or confidential information reaches people who shouldn't see it, by accident or through weak security, rather than through a deliberate attack on the system holding it.
• Data management Data management is the planning, policies and day-to-day practices an organization uses to handle its data, from collection to deletion, so the data stays accurate, protected and useful.
• Data mapping Data mapping is the process of working out what personal data an organisation holds, where it comes from, where it is stored and who it is shared with. It is usually the first step in building a record of processing activities.
• Data masking Data masking is replacing real values in a data set, such as a phone number or name, with substitutes like asterisks or a random pseudonym, so the real information is hidden but the data stays usable in form.
• Data mining Data mining is analyzing large collections of data to find patterns, links and trends. Companies use it to predict behavior, target ads and score risk, and when the data is about people it raises privacy questions.
• Data owner A data owner is the person or role accountable for a set of data and for deciding how it is collected, used, protected and disposed of. In security frameworks, it is the official who sets the controls for that information.
• Data point A data point is a single piece of information, such as one measurement, one fact or one answer. In privacy, each detail about you (a name, an address, a phone number) is a data point.
• Data processing Data processing means doing anything with personal data, such as collecting, recording, organising, structuring or storing it. Under the GDPR, almost every use of information about a person counts as processing.
• Data protection policy A data protection policy is an organisation's internal document that sets out how it handles personal data, who is responsible, and how it follows data protection law.
• Data purge A data purge is the permanent removal of data so that it cannot be recovered. In NIST's media sanitization guidance, purge means making recovery infeasible even with state-of-the-art laboratory techniques.
• Data steward A data steward is the person or group responsible for how a set of data is protected, shared and kept accurate, including enforcing the policies that govern it.
• Demographic data Demographic data is information about the statistical characteristics of a population, such as age, income or location, used especially to identify and describe groups of people for markets, planning and research.
• Dynata Dynata is a market research company that supplies sampling technology and survey respondents to businesses, universities and government agencies, and it may contact people by phone, email, post or online.
• Geo data Geo data is information that ties something to a place on Earth. In privacy, it usually means location data from your phone, car or apps that shows where you are or have been.
• Geographical data Geographical data is information that describes where something is on Earth, such as coordinates, addresses, boundaries, roads or regions. It becomes personal data when it can be linked to a specific person, such as a home address.
• Geolocation data Geolocation data is information that shows where a device, and so usually its owner, is or has been. It comes from GPS, Wi-Fi, mobile networks and IP addresses, and it can reveal where you live, work and spend your time.
• Non-PII Non-PII is information that doesn't identify a person on its own and can't reasonably be linked to one, such as properly de-identified data. The line isn't fixed: data that isn't PII today can become PII when it's combined with other data.
• Personal attribute A personal attribute is a single fact about a person, such as their name, age, address or job. Attributes that can identify someone, alone or combined, count as personal information.
• Personal data Personal data is any information about a living person who can be identified from it, directly or indirectly, such as a name, an address, an ID number, location data or an online identifier like an IP address.
• PHI PHI is health information tied to a specific person and held by a healthcare provider, health plan or their partners, which HIPAA protects. PII is the broader category: any information that can identify a person.
• PHI (protected health information) Protected health information (PHI) is health information that can identify a person, such as a medical record number, diagnosis tied to a name or an appointment date, when a HIPAA-covered organization holds or shares it.
• PII (personally identifiable information) PII (personally identifiable information) is any information that can identify a specific person, either on its own (such as a Social Security number) or when combined with other details (such as birth date and place of birth).
• PII data (personally identifiable information) PII data is any information that can identify a specific person, either on its own or when combined with other details about them. Names, Social Security numbers and biometric records are common examples.
• Private data Private data is information about you that you haven't chosen to make public and that could be used to identify you or harm you if others got it, such as your home address, ID numbers, health details or account logins.
• Prosper data breach The Prosper data breach was a 2025 security incident at Prosper Marketplace, a US peer-to-peer lender, that exposed customer data such as names, Social Security numbers and birth dates.
• Public records (US) Public records are documents held by government bodies that, with some exceptions, the public has a legal right to see. They can include court files and other records that hold personal details about you.
• Sensitive data Sensitive data is personal information that carries a higher risk of harm or discrimination if it leaks, such as health, religion, sexual orientation, political views or biometric data, and that privacy law protects more strictly.
• Special category data Special category data is the more sensitive kind of personal data that the UK GDPR protects more strictly, such as health, genetic and biometric data, or information about race, religion, politics, trade union membership, sex life or sexual orientation.
• User data User data is information a person provides or generates while using a website, app or service, such as an account name, email address, activity history and settings. When it identifies someone, it counts as personal data.

See where your personal data is exposed

Serus finds it on data brokers and people-search sites and removes it.

Run a free scan