Personally Identifiable Information (PII)
Information that can be used to identify a specific individual, either directly or in combination with other data.
Full Definition
Personally Identifiable Information (PII) is primarily a US term, used in NIST SP 800-122, OMB guidance and most US sector-specific laws (HIPAA, GLBA, FCRA, state privacy laws). It covers direct identifiers (name, address, SSN, biometrics, email) and quasi-identifiers that identify an individual in combination (date of birth plus postcode plus gender). Many US frameworks further distinguish Sensitive PII (SSN, financial accounts, biometric, health, children's data) with stricter handling requirements.
Outside the US, PII maps approximately onto 'personal data' under GDPR Article 4(1), 'personal data' under DPDP Section 2(t), and 'personal data' under PDPA Section 2. The frameworks are not identical — GDPR's 'personal data' is intentionally broader than NIST PII, and the EU rejects the US distinction between PII and non-PII because an identifiable individual is identifiable regardless of which attribute does the identifying. For global programmes, treating PII and personal data as a single operational category under the strictest applicable rule is cheaper than maintaining parallel definitions.
Related terms
Personal Data
Any information that relates to an identified or identifiable natural person.
Protected Health Information (PHI)
Health information that identifies an individual, created or received by a HIPAA-covered entity, and subject to the HIPAA Privacy and Security Rules.
Data Classification
The process of labelling each data asset with its sensitivity, regulatory category and handling requirements.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes