Any data that could be used to identify a specific individual is called Personally Identifiable Information (PII). PII includes direct identifiers like a full name or Social Security number, as well as indirect identifiers like an email address or date of birth. Organizations collect PII for purposes such as employment, healthcare, or financial transactions, and must protect it from unauthorized access or disclosure.
Common Examples
PII encompasses a broad range of data types, including:
- Full name: An individual’s legal name.
- Social Security number (United States): A unique identifier issued by the U.S. government.
- Driver’s license number: A state-issued identifier for licensed drivers.
- Passport number: A government-issued travel document number.
- Email address: A unique identifier for digital communication.
- Phone number: A contact number linked to an individual.
- Home address: A physical location where an individual resides.
- Date of birth (DOB): An individual’s birth date.
- Biometric data: Unique biological characteristics like fingerprints or facial recognition data.
Legal and Regulatory Context
The definition of PII varies by jurisdiction and regulatory framework. In the United States, the National Institute of Standards and Technology (NIST) defines PII as "any information about an individual maintained by an agency." Under European Union and United Kingdom data protection laws, the term "personal data" is broader and aligns with the General Data Protection Regulation (GDPR). Other regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), impose strict requirements for handling and protecting PII to prevent identity theft and other malicious activities.
