What is not PII?
Definition
Non-PII is information that doesn't identify a person on its own and can't reasonably be linked to one, such as properly de-identified data. The line isn't fixed: data that isn't PII today can become PII when it's combined with other data.
- Category
- Data
- Also called
- non-personally identifiable information, non-PII data
- Last updated
NIST defines PII as information that can identify a person, either on its own or when combined with other information that is linked or linkable to that person. Anything outside that definition is non-PII.
NIST's SP 800-122 explains the difference between the two kinds of connection. Linked information is logically associated with a person. Linkable information only has a possibility of such an association, and NIST treats data as linkable when the other source is remote or publicly obtainable, for example through a search engine. So a record with no name can still be PII if someone could look up the missing piece.
What usually counts as non-PII
Information from which enough has been removed that it no longer identifies anyone, and where there's no reasonable basis to believe it can be used to identify someone. NIST calls this de-identified information. Data about things rather than people, such as a company's public product catalogue, also falls outside PII.
Why "not PII" isn't "safe"
Two cautions from NIST's own documents:
- De-identification reduces the risk but doesn't remove it. NIST's SP 800-188 says de-identified data could still be linked back to a person.
- SP 800-122 says that even if information isn't PII, an organisation should still consider whether it's sensitive.
OMB guidance quoted by NIST adds that PII isn't a fixed list and calls for case-by-case judgement, and that non-PII can become PII when it's combined with newly available information.
Non-PII vs. personal data
PII is mostly a US term. The UK and EU use "personal data", which is defined more broadly and includes things like online identifiers and location data.
How to protect yourself
- 1
Treat combinations as identifying
A zip code, birth date and gender may each look harmless. Together they can point to one person. Be careful sharing several details at once.
- 2
Check what a form really collects
Before signing up, read what the service says it shares or sells. "Anonymous" or "non-personal" data can still be linked back.
- 3
Limit what's public about you
Public records and people-search listings supply the missing pieces that turn non-PII into PII. Serus finds where your address and phone number are listed and removes them.
- 4
Use separate emails for sign-ups
A spare address keeps one company's data from being matched with your main identity.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is an IP address PII?
It depends on the rules you're asking about. The UK GDPR lists online identifiers as personal data. US definitions depend on context and on whether it can be linked to a person.
Is a zip code PII?
On its own, often not. Combined with other details like birth date and gender, it can identify a person, which is why NIST says to judge each case in context.
Is anonymized data PII?
Properly de-identified data isn't PII, but NIST warns that de-identified data can sometimes be linked back to a person.
What is the difference between PII and non-PII?
PII can identify a person alone or combined with linked or linkable information. Non-PII can't, though it may become PII once combined with other data.
Sources
Something wrong or out of date? Tell us and we'll re-check it.