Personally Identifiable Information (PII).

Any data that can identify a specific individual on its own or when combined with other information, such as names, identifiers, or biometric records. It belongs to the Privacy & Data Protection category of cybersecurity.

Any data that can identify a specific individual on its own or when combined with other information, such as names, identifiers, or biometric records.

Personally Identifiable Information (PII) refers to data that distinguishes or traces an individual's identity, either directly (name, government ID, email) or indirectly when linked with other attributes (date of birth, ZIP code, device identifiers). Regulators distinguish direct identifiers, quasi-identifiers, and sensitive categories such as health or biometric data, which carry stricter handling rules under GDPR Article 9 and U.S. sectoral laws like HIPAA. Organizations inventory PII, apply data classification, encrypt it at rest and in transit, restrict access on a need-to-know basis, and log processing activities. Effective programs also document lawful bases, minimization, and retention to limit exposure during a breach.

Defences for Personally Identifiable Information (PII) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Personal Data, Personal Information.