PII is any information that can identify a specific person, either on its own or when pieced together with other data. Your name, Social Security number, email address, your phone, even your ZIP code combined with your birthday, all of it counts. The reason PII keeps security and compliance teams up at night is simple: it multiplies. One customer record gets copied into a spreadsheet, exported to a reporting tool, pasted into a chat, and suddenly the same person’s data lives in a dozen places nobody is tracking.
This guide explains what PII is, what actually counts, the difference between sensitive and non-sensitive PII, how it compares to PHI and personal data, why it matters, and how to find and protect it. Plain definitions first, then the practical part.
What is PII?
PII stands for personally identifiable information. It’s any data that can be used to identify a particular individual, either directly or in combination with other information. In cyber security and privacy work, PII is the category of data that regulations are designed to protect, because it’s the data that hurts people when it leaks.
Privacy frameworks split PII into two kinds of identifiers, and the distinction matters more than most people expect.
Direct identifiers: Data that points to one person on its own, like a full name, Social Security number, passport number, driver’s license number, email address, or phone number. Hand someone a passport number and they can find the individual.
Indirect identifiers: Data that doesn’t identify anyone on its own but can when combined, like date of birth, ZIP code, gender, or IP address. Any one of these describes millions of people. Put three of them together and they usually narrow to one.
That second category is the trap. Teams protect the obvious direct identifiers and leave indirect ones lying around, not realizing that a birthdate plus a ZIP code plus a gender is often enough to re-identify someone.
What counts as PII, with examples
The clearest way to answer “what is considered as PII” is to look at the data itself. Common examples of PII include:
- Full name, especially combined with other details
- Social Security number, national ID, or tax ID
- Passport and driver’s license numbers
- Email address and phone number
- Home address
- Date and place of birth
- Bank account and payment card numbers
- Biometric data, like fingerprints or facial scans
- IP address and device identifiers
- Login credentials tied to an identity
A question that comes up constantly is whether an email address is PII. Yes, it is. An email address is PII because it identifies or contacts a specific person, and most privacy laws treat it that way. The same goes for an IP address in most modern frameworks, since it can be tied back to an individual or household.
The list above isn’t fixed, and that’s the point. Whether a piece of data is PII depends on context. A first name alone usually isn’t identifying. The same first name attached to a ZIP code and an employer often is.
Sensitive vs non-sensitive PII
Not all PII carries the same risk, and regulations treat the two tiers differently.
Sensitive PII: Data that can cause real harm if exposed, including Social Security numbers, financial account details, medical records, biometric data, and login credentials. This is the tier that triggers breach-notification obligations and the heaviest penalties.
Non-sensitive PII: Data that’s often public or low-risk on its own, like a name, a work email, or a ZIP code. It becomes dangerous mainly when it’s combined with sensitive PII to build a fuller profile of someone.
The practical takeaway is that sensitive PII needs the strongest controls, encryption, tight access, close monitoring, while non-sensitive PII still needs handling, because attackers assemble it into something sensitive.
PII vs PHI vs personal data
These three terms get used interchangeably, and they shouldn’t be.
PII is the general term for data that identifies a person, used most often in the US and in security contexts.
PHI, or protected health information, is the health-specific subset governed by HIPAA in the US. It’s PII that also relates to someone’s health, care, or payment for care, and it carries its own strict handling rules.
Personal data is the broader term used by GDPR in Europe and India’s DPDP Act. It covers more ground than the classic US definition of PII, sweeping in things like online identifiers and location data more explicitly. If you operate across regions, personal data is usually the widest net, so building to that standard tends to cover the others.
Why PII matters
PII is the raw material of identity theft and fraud. When it leaks, attackers use it to open accounts, run phishing that actually works because it’s personalized, and impersonate people to get past support desks. The damage lands on real customers, and then on the company that failed to protect them.
There’s a regulatory weight too. Under laws like GDPR, HIPAA, CCPA, and India’s DPDP Act, the personal data an organization holds is required to be protected with appropriate safeguards, and breaches are required to be reported within defined timelines. Where those obligations are missed, penalties and mandatory disclosures follow, and the reputational cost usually outlasts the fine.
So the stakes are both human and financial, which is why “where is our PII and who can touch it” is a question every security and compliance team should be able to answer at any moment. Most can’t, and that gap is where incidents start.
How to protect PII
Protecting PII is less about buying one tool and more about getting a few fundamentals right in order. Here’s the sequence that actually works.
Find it first: You can’t protect data you can’t see, so start by discovering where PII lives across your cloud, SaaS apps, databases, and endpoints. This is where most programs stall, because sensitive data spreads far beyond the systems anyone documented. A live inventory of sensitive data is exactly what data discovery and classification solves, and Matters.AI’s DSI builds that map with risk scoring so you know what’s exposed before an attacker does.
Classify what you find: Label each piece of data by sensitivity so the right controls apply automatically instead of by hand. Classification is what turns a pile of files into a map you can act on.
Limit who can reach it: Apply least privilege so people and systems get access to only the PII their role needs, and review that access when roles change.
Watch it move: Monitor how PII travels, and stop it from leaving through unsanctioned channels. Catching a bulk export or a risky upload as it happens is the job of data loss prevention, and it’s the difference between a near-miss and a breach notification.
Encrypt and retain with intent: Encrypt sensitive PII at rest and in transit, and delete what you no longer need, because data you don’t keep can’t leak.
Bringing it together
PII comes down to one idea: if data can point back to a person, it needs protecting, and the more of it you combine, the more identifying it gets. The direct identifiers are easy to spot. The indirect ones, and the copies of sensitive data scattered across systems nobody’s watching, are what actually cause breaches.
Start by finding where your PII lives, classify it, control who can reach it, and watch it move. Solve the visibility problem first, because every other safeguard depends on knowing what you have and where it is.
