PII

What it means

Personally identifiable information is any data that points at a specific person. Names, email addresses, phone numbers, postal addresses, identity and tax numbers, account numbers, photographs, location history, device identifiers.

It is broader than most people assume, because identification often comes from a combination rather than one field. A postcode alone is nothing. A postcode with a date of birth and a job title usually names one person. The UK regulator asks exactly that question: can you identify somebody indirectly, using other information you hold?

Why it matters

It changes what an incident costs. A breach of internal documents is a bad week. A breach of customer personal data brings notification deadlines, a regulator, individual complaints and a story with your company's name in it.

Enterprise buyers ask about it for the same reason. Your breach becomes their breach when their customers' data sat in your system. Most of a security questionnaire is this one topic wearing different hats.

How it shows up

The problem is rarely the main database, which everybody protects. It is the copies. Logs recording full request bodies. Error reports carrying customer records. Analytics events with email addresses in them, spreadsheets on laptops, support tickets with identity documents attached, backups older than the retention policy, test environments loaded from production.

The controls that hold are unfashionable. Collect less to begin with. Delete on a schedule and prove it, mask fields by default in internal tools, and keep personal data out of logs. Above all, know which systems hold it, because you cannot protect what is not on the list.