Glossary of terms

Personally Identifiable Information (PII)

Personally identifiable information (PII) is data that can be used to identify a specific individual. All data that can be directly or indirectly linked to an individual is considered PII. Examples of such information include name, email address, telephone number, bank account, and personal identification number.

There is no single clear definition of PII, but there are generally accepted concepts. For example, the National Institute of Security Technology (NIST) provides one of the most widely used definitions of PII:
“Any information about an individual maintained by an entity, including any information that can be used to identify or track a specific individual, such as name, social security number, date and place of birth, mother’s maiden name, or biometric data; and any other information that is or can be linked to a specific individual, such as medical, educational, financial, and employment information.”

Privacy is often defined as the ability of an individual to determine the terms and conditions of sharing their personal information, such as personal data. Ensuring privacy protection requires individuals to know what data is being collected about them and how it will be used.

Organizations that collect and process personally identifiable information (PII) must identify what data they hold and how that data is protected from unauthorized access. PII is divided into two main types: information that directly identifies an individual and information that does so indirectly.

For example, a full name, social security number, or physical address belongs to the first type, which directly identifies a person. While other information that is not a direct identifier can indirectly identify a person when combined with other data. Being aware of these intricacies of PII identification and processing is important to ensure that user privacy is effectively protected.

Blog