Digital Lexicon Hub

Information that can identify a specific person on its own or when combined with other data, such as a name, email address or ID number.

Knowing where PII sits in analytics, CRM, ad platforms and AI tools determines security controls, breach exposure and privacy duties, and sending PII to the wrong system can breach platform policies and data protection law.

A data team scans its BigQuery tables, tags 14 columns holding emails, phone numbers and addresses as PII, restricts them to two roles, hashes emails with SHA-256 before ad platform uploads and strips PII from URLs sent to GA4.

PII is a US-origin term with no single legal definition, and GDPR personal data is broader, covering cookie IDs, IP addresses and pseudonymized data. Removing obvious identifiers does not make data anonymous, because combined fields can reidentify people.

NIST SP 800-122 defines PII as information that can distinguish or trace an individual's identity, such as name, Social Security number or biometric records, plus information linked or linkable to that person, such as medical, financial or employment data. It recommends setting a confidentiality impact level for each PII set. Common controls are minimization, access limits, Encryption at Rest, masking and Data Tokenization, and Enhanced Conversions hashes PII before sending.