What is PII data, and what counts as PII?

There is no single legal definition of PII in the United States. The most widely used one comes from the National Institute of Standards and Technology (NIST), which describes PII as “any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.”

Two parts of that sentence matter in practice. Information can identify a person directly, and information that does not identify anyone alone can still be PII when it can be linked to a person.

Direct and indirect identifiers

A direct identifier points to one person without help. NIST lists names, personal identification numbers such as a passport, Social Security, driver’s license, taxpayer identification, or financial account number, address information such as a street address or email address, and personal characteristics such as a photograph of a face, fingerprints, handwriting, or other biometric data.

An indirect identifier identifies someone only in combination. NIST lists date of birth, place of birth, race, religion, weight, activities, geographical indicators, and employment, medical, education, and financial information as information that is linked or linkable to one of the direct identifiers. NIST gives an example of how context decides: ZIP codes and dates of birth can indirectly identify individuals or significantly narrow a large dataset, while an area code and gender alone usually would not, depending on the context and the size of the sample.

Examples of PII

Sensitive categories of PII

Some PII carries more risk if it leaks. NIST asks organizations to weigh how sensitive the data fields are, how many records are involved, how identifiable the person is, and the context and obligations that apply. Under the European Union’s GDPR, Article 9 names special categories of personal data that get extra protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, data concerning health, and data concerning a person’s sex life or sexual orientation.

PII, PHI, and personal data under GDPR

The terms overlap but are not interchangeable.

HIPAA also defines what counts as de-identified. The Safe Harbor method in 45 CFR 164.514(b)(2) requires removing 18 kinds of identifiers of the individual and of relatives, employers, or household members, including names, geographic units smaller than a state, all elements of dates except year, telephone and fax numbers, email addresses, Social Security numbers, medical record numbers, account numbers, device identifiers, web addresses, IP addresses, biometric identifiers, and full-face photographs. For how HIPAA applies to AI tools, see Is AI HIPAA compliant?.

The UK Information Commissioner’s Office adds a point that applies to the same idea under GDPR: pseudonymised data is still personal data when the person can be linked back using additional information held separately.

How organizations find and protect PII

NIST organizes protection into operational safeguards, privacy-specific safeguards, security controls, and incident response. In practice that means:

1. Find it. List the systems, files, and tools where PII is created, stored, or sent, including the AI tools staff use.
2. Rate it. NIST recommends weighing identifiability, quantity, data field sensitivity, context of use, the obligation to protect it, and who can access it and where it sits.
3. Collect and keep less. NIST calls minimizing the use, collection, and retention of PII a basic privacy principle, and recommends reviewing holdings and destroying PII that serves no current purpose.
4. Write the policy and train people. NIST lists policy and procedure creation and awareness training as operational safeguards.
5. Remove identifiers when you can. De-identifying records removes enough PII that the remaining information does not identify a person and there is no reasonable basis to believe it can be used to do so. De-identified data can sometimes be re-identified, so treat the method as a risk decision.
6. Control access and plan for a breach. Apply security controls, and have an incident response process for a loss of PII.

Detection tools find values that match PII patterns, and masking or redaction replaces them. The glossary entries for PII detection, PII masking, and PII redaction define each term, and the guide to redacting PII before an LLM shows where those controls sit in a request to an AI tool.

PII and AI tools

PII reaches an AI tool when a person types or pastes it into a prompt or uploads a file. What happens next depends on the account and plan. What happens to what you type into an AI chat? explains the path, and how to stop company data leaking into AI tools covers the controls.