PII (personally identifiable information) is data that can be used to identify, contact or locate a specific individual, either by itself or when combined with other information.
Why it matters
PII is the data privacy laws protect and attackers want. Names, emails, addresses, government ID numbers and financial details all qualify, and even IP addresses or device identifiers may count under some laws like GDPR. Reducing what you collect, restricting access and encrypting it limits risk.
Regulations define the term differently, so treat anything linkable to a person as sensitive until you confirm otherwise, and handle categories such as health or financial data with extra care.
Example
A customer table with name, email, phone and birth_date is PII. A single field such as a postcode may not identify anyone alone, but together with age and gender it can narrow to one person.
Common mistakes
- Assuming only obvious fields like names count.
- Copying production PII into test environments or logs.
- Keeping it indefinitely instead of setting a retention period.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.