What is PII?
Definition
PII (personally identifiable information) is any information that can identify a specific person, either on its own (such as a Social Security number) or when combined with other details (such as birth date and place of birth).
- Category
- Data
- Also called
- personally identifiable information, personal information, Personally identifiable information (PII)
- Last updated
PII stands for personally identifiable information. NIST's glossary defines it as information that can be used to distinguish or trace a person's identity, alone or when combined with other information linked or linkable to that person. That second half matters: a detail can be harmless by itself and identifying once it's paired with others.
What counts as PII
Some details point to you directly: your full name, Social Security number, passport number, driver's license number, fingerprints and other biometric records. Others only identify you in combination. NIST's examples include date and place of birth and mother's maiden name. A broader US government definition, from the Office of Management and Budget, says PII is any information that permits the identity of a person to be reasonably inferred, directly or indirectly.
A typical case: your ZIP code, birth date and gender won't name you on their own, but together they narrow things to very few people.
Why it matters
Fraudsters use PII to open accounts, file fake tax returns, reset passwords and impersonate you on the phone. Scammers use it to make messages sound credible. It also fills the profiles on people-search sites, where your name, address, phone number and relatives appear in one place.
PII vs. personal data
"Personal data" is the term used in the EU and UK GDPR for any information relating to an identified or identifiable person. It's close to PII but defined by law and a little wider, covering things like online identifiers. In practice, if it can be linked to you, treat it as sensitive.
Sensitive vs. public PII
Some PII, like your name, may be widely known. Some, like your SSN or financial account numbers, can cause serious harm if exposed. Protect the second kind hardest, but remember that the public kind is what strangers use to find the rest.
How to protect yourself
- 1
Share less by default
Give out only what a form or a person really needs. Skip optional fields like birth date and phone number where you can.
- 2
Guard the high-risk items
Keep your Social Security number, passport and account numbers out of email and chat. Use a password manager and two-step verification so a leaked password doesn't open your accounts.
- 3
Check where your details are listed
People-search sites and data brokers publish PII such as your address, phone number and relatives. Each has its own opt-out, listed in our data broker guides. Serus finds where your information is listed and removes it, then watches for it coming back.
- 4
Shred and dispose carefully
Shred paper with account numbers, and wipe old phones and laptops before you sell or recycle them.
- 5
Watch for misuse
Check your bank and card statements, and look at your credit reports for accounts you didn't open.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What does PII stand for?
PII stands for personally identifiable information.
Is an email address PII?
It can be. An address that includes your name clearly points to you, and even a plain one can be linked to you when combined with other details. Treat it as PII.
Is a phone number PII?
Yes, in most definitions. A phone number is linked to a person and is used to find, contact or verify them, which is why it appears on people-search sites.
What's the difference between PII and personal data?
PII is mostly a US term. Personal data is the GDPR term for any information relating to an identifiable person. The two overlap heavily, and personal data is generally the broader one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.