Personally identifiable information (PII)

How it works

NIST's glossary defines PII as information that can be used to distinguish or trace an individual's identity, such as name, Social Security number or biometric data records, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual (FIPS 201-3). A second NIST wording, from SP 800-122, adds that PII can include medical, educational, financial and employment information when it is linked or linkable to a person.

The key word is linkable. A birth date alone identifies nobody. A birth date plus a name plus an employer often does.

Where PII shows up in stolen data

Breach records frequently carry a mix of direct identifiers and contact details: names, email addresses, phone numbers, usernames and sometimes addresses or government identifiers. The FBI's annual report treats a personal data breach as a security incident in which an individual's sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an unauthorized individual. For executives, the same fields are what fraudsters and harassers collect. Executive digital exposure explains which fields matter and why.

Combined across several breaches, low-sensitivity fields build a profile. That profile feeds pretexting, BEC and doxxing.

Reducing the risk

Organizations reduce PII risk by collecting less, keeping it for shorter periods and restricting who can see it. Individuals can limit what they publish and use separate email addresses and phone numbers for separate purposes. For staff in visible roles, reviewing what appears in public records and on personal social media is a sensible first step. CISA's doxing guidance lists removing PII such as address, date of birth and phone number from social media profiles among its recommended measures. For listings that publish an executive's PII on people-search sites, WebThreat's Information Removal specialists file the opt-outs and takedown requests and verify each removal.

How it differs from related terms

PII is the term used by NIST and in United States federal guidance such as OMB Circular A-130. The GDPR uses "personal data", which Article 4(1) defines as any information relating to an identified or identifiable natural person. The two overlap heavily but are not identical, and a question about which one applies needs legal advice. A credential pair can be PII when the username is an email address, but a password on its own usually identifies no one. Sensitive PII, such as a government identifier, carries higher harm than a name.

This page is general information and not legal advice.