What is PII data?
Definition
PII data is any information that can identify a specific person, either on its own or when combined with other details about them. Names, Social Security numbers and biometric records are common examples.
- Category
- Data
- Also called
- PII, personally identifiable information, personal identifiable information
- Last updated
PII stands for personally identifiable information. NIST's glossary, which draws on the US Office of Management and Budget's definition, describes it as information that can be used to distinguish or trace an individual's identity, such as a name, a Social Security number or biometric records, either alone or when combined with other information that is linked or linkable to that person.
The second half of that definition is the part people miss. A single detail often isn't enough to point at you. Your first name alone, or your ZIP code alone, doesn't identify anyone. But a first name, a ZIP code and a birth date together might narrow things down to one person.
Examples of PII
Some details identify you directly: your full name, Social Security number, passport number, driver's license number, fingerprints. Others only identify you when they're combined: your date of birth, your workplace, your street, your mother's maiden name. NIST's older guidance on PII also counts linked records such as medical, educational and financial information.
Why it matters
PII is what identity thieves and scammers need. A criminal with your name, date of birth and Social Security number can try to open accounts in your name. A scammer with your name and phone number can make a call sound like it comes from someone who knows you. People-search sites and data brokers collect and publish a lot of this information, which is why it often turns up on pages you never signed up for.
PII vs. personal data
"PII" is mostly a US term. Laws such as the GDPR use "personal data" instead. NIST's glossary lists the two as related terms, and in practice they overlap a lot, but the legal definitions differ. If you're reading a privacy policy, check which term it uses and which law it cites.
How to protect yourself
- 1
Share the minimum
Give out your Social Security number, date of birth and home address only when a legitimate service really needs them. If a form asks for more than the task requires, leave the optional fields empty.
- 2
Find out who lists you
Search your name with your city and look at what people-search sites show. These pages often combine your address, phone number and relatives in one place. Serus finds where your address and phone number are listed and removes them for you.
- 3
Remove your details from Google results
Google's Results about you tool lets you ask for search results that show your phone number, home address or email to be taken down.
- 4
Lock down your accounts
Use a unique password for each account and turn on two-factor authentication, so a leaked password doesn't expose the PII stored in the account behind it.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is an email address PII?
It can be. An address such as firstname.lastname@company.com points straight at one person. A random string at a free email provider is less obvious, but it can still be linked to you when combined with other details. Treat it as identifying.
What is the difference between PII and sensitive PII?
Sensitive PII is the subset that causes the most harm if it leaks, such as a Social Security number, passport number or financial account details. Names and work phone numbers are usually treated as less sensitive. How a given organisation draws the line varies, so check its privacy policy.
Is a phone number PII?
Yes, in most definitions. A phone number is linked to a specific person and is often combined with a name and address on people-search sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.