# Personally Identifiable Information (PII): Definition, Types, and Examples

![Personally Identifiable Information (PII)](https://www.investopedia.com/thmb/YRBFjlPBqD3Nex7ye0duq0ZWa2U=/1500x0/filters:no_upscale():max_bytes(150000):strip_icc()/Personally-identifiable-information-pii_final-f413d282a7b74142b147720a77811659.png)

*— Michela Buttignol / Investopedia*

## What Is Personally Identifiable Information (PII)?

Personally identifiable information (PII) constitutes any data that can pinpoint an individual, either by itself or when combined with other information.

This includes direct identifiers, such as passport details, which alone can distinguish an individual. It also encompasses quasi-identifiers like race or birthdate, which can be pieced together to reveal someone's identity. As the digital landscape expands, understanding and safeguarding PII becomes a pressing concern for individuals, corporations, and governments alike

### Key Takeaways

*   Personally identifiable information (PII) is any data that can uniquely identify an individual, making it a prime target for identity theft and cyberattacks.
*   Sensitive PII includes data such as Social Security numbers and biometric records, while nonsensitive PII might include basic information like an individual's name.
*   The proliferation of big data has increased the risk of data breaches, prompting regulatory bodies worldwide to implement laws safeguarding PII.
*   Techniques like anonymization and encryption are crucial for companies to protect their clients' PII when sharing data with other entities.
*   High-profile data breaches, such as the Facebook-Cambridge Analytica scandal, highlight the significant legal and reputational consequences for companies failing to protect PII.

### Types of Personally Identifiable Information

Either direct and sensitive or indirect and nonsensitive, PII types include but are not limited to:

*   Credit card information
*   Date of birth
*   Driver’s license
*   Financial information
*   Full name
*   Gender
*   Mailing address
*   Medical records
*   Passport information
*   Place of birth
*   Race
*   Religion
*   Social Security number (SSN)
*   ZIP code

## The Role of PII in the Digital Age

Advancing technology platforms have changed the way businesses operate, governments legislate, and individuals relate. With digital tools like cellphones, the internet, ecommerce, and social media, there has been an explosion in the supply of all kinds of data.

[Big data](https://www.investopedia.com/terms/b/big-data.asp), as it is called, is being collected, analyzed, and processed by businesses and shared with other companies. The wealth of information provided by big data has enabled companies to gain insight into how to better interact with customers.

However, the emergence of big data has also increased the number of data breaches and cyberattacks by entities who realize the value of this information. As a result, concerns have been raised over how companies handle the sensitive information of their consumers. Regulatory bodies are seeking new laws to [protect the data of consumers](https://www.investopedia.com/surveillance-pricing-11701007), while users are looking for more anonymous ways to stay digital.

## Differentiating Sensitive and Nonsensitive PII

### Sensitive PII

Personally identifiable information (PII) can be sensitive or nonsensitive. Sensitive personal information includes legal statistics such as:

*   Full name
*   [Social Security number (SSN)](https://www.investopedia.com/terms/s/ssn.asp)
*   Driver’s license
*   Mailing address
*   Credit card information
*   Passport information
*   Financial information
*   Medical records

The above list is by no means exhaustive.

Companies often [anonymize](https://www.investopedia.com/terms/d/data-anonymization.asp) PII by encrypting it before sharing, making it not personally identifiable. Insurance companies often mask sensitive PII, only sharing data relevant to marketing.

### Nonsensitive PII

Nonsensitive or indirect PII is easily accessible from public sources like phone books, the internet, and corporate directories. Examples of nonsensitive or indirect PII include:

*   ZIP code
*   Race
*   Gender
*   Date of birth
*   Place of birth
*   Religion

The above list contains quasi-identifiers and examples of nonsensitive information that can be released to the public. This information alone can't identify someone.  

However, nonsensitive information—although not delicate—is linkable. This means that nonsensitive data, when used with other personal linkable information, can reveal the identity of an individual. [De-anonymization](https://www.investopedia.com/terms/d/deanonymization.asp) is possible when multiple quasi-identifiers are combined to identify someone.

> **Important**
>
> Protecting PII is a major concern for individuals, companies, and governments.

## How to Safeguard Personally Identifiable Information

Multiple data protection laws have been adopted by various countries to create guidelines for companies that gather, store, and share the personal information of clients. These laws often prohibit the collection of sensitive data unless necessary.

Regulations require deleting unnecessary data and avoiding sharing it with untrustworthy sources.

[Cybercriminals](https://www.investopedia.com/articles/personal-finance/040115/watch-out-these-top-internet-scams.asp) breach data systems to access PII and then sell it to willing buyers in underground digital marketplaces. For example, in 2015, the Internal Revenue Service (IRS) suffered a data breach leading to the theft of more than 100,000 taxpayers’ PII.

Using quasi-information stolen from multiple sources, the perpetrators were able to access an IRS website application by answering personal verification questions that should have been privy to the taxpayers only.

> **Fast Fact**
>
> Safeguarding PII may not always be the sole responsibility of a service provider. In some cases, it may be shared with the individual.

## Common Methods of PII Theft  

Thieves often find PII by rummaging through trash for unopened mail. This can yield a person’s name, address, employment info, banking details, or Social Security numbers.

Nowadays, the internet has become a major vector for identity theft. [Phishing](https://www.investopedia.com/terms/p/phishing.asp) and [social engineering](https://www.investopedia.com/terms/s/social-engineering.asp) attacks use a deceptive-looking website or email to trick someone into revealing key information, such as their name, bank account numbers, passwords, or Social Security number. It is also possible to steal this information through deceptive phone calls or SMS messages.

## Effective Strategies for PII Protection

While it is not possible to fully protect yourself, you can make yourself a smaller target by reducing the opportunities to steal your PII. Experian suggests ways to minimize your exposure risk.

For example, a locked mailbox or P.O. box makes it harder for thieves to steal your mail, and removing personal identification from junk mail and other documents makes it harder for identity thieves to associate a name with an address. Don't carry unnecessary PII, like your Social Security card, in your wallet.

Likewise, there are some steps you can take to prevent [online identity theft](https://www.investopedia.com/after-identity-theft-8773806). Data leaks are a major source of identity theft, so it is important to use a different, complex password for each online account. Always encrypt your important data, and use a password for each phone or device. It is also a good idea to reformat your hard drive whenever you sell or donate a computer.

## Global Perspectives on PII Regulations  

The definition of what comprises PII differs depending on where you live in the world. Here’s how different regions handle privacy.

### United States

In the United States, the government defined “personally identifiable” in 2020 as anything that can “be used to distinguish or trace an individual’s identity,” such as name, SSN, and biometrics information; either alone or with other identifiers such as date of birth or place of birth.

### Europe

In the [European Union (EU)](https://www.investopedia.com/terms/e/europeanunion.asp), the definition expands to include quasi-identifiers as outlined in the [General Data Protection Regulation (GDPR)](https://www.investopedia.com/terms/g/general-data-protection-regulation-gdpr.asp) that went into effect in May 2018. The GDPR is a legal framework that sets rules for collecting and processing personal information for those residing in the EU.

### Australia

Personal information is protected by the Privacy Act 1988. This law regulates the collection, storage, use, and disclosure of personal information, whether by the federal government or private entities. Later amendments regulate the use of healthcare identifiers and establish the obligations of entities that suffer from a data breach.  

### Canada

The Personal Information Protection and Electronic Documents Act regulates the use of personal information for commercial use. This is defined as information that, on its own or combined with other data, can identify you as an individual.  

## Personally Identifiable Information vs. Personal Data

Personal data encompasses a broader range of contexts than PII—for instance, your IP address, device ID numbers, browser cookies, online aliases, or genetic data. Certain attributes such as religion, ethnicity, sexual orientation, or medical history may be classified as personal data, but not personally identifiable information.  

## Major Incidents of PII Breaches

There have been many instances where customer PII has been stolen from companies. Often, this has resulted in hefty fines.

The biggest fine on record, as of October 2023, was handed to Didi Global. The Chinese ride-hailing company was fined 8.026 billion yuan ($1.1 billion) by the Cyberspace Administration of China for breaching the nation’s network security law, data security law, and personal information protection law. Other recipients of big fines for failing to adequately protect personally identifiable information include Equifax, Amazon, and Meta.

### Facebook-Cambridge Analytica Data Scandal

One of the most well-known cases belongs to Meta, or Facebook as it was then known. In the 2010s, the profiles of 30 million Facebook users were collected without their consent by an outside company called Cambridge Analytica_._ Cambridge Analytica got its data from Facebook through a researcher who worked at the University of Cambridge. The researcher built a Facebook app that was a personality quiz.

The app was designed to take the information from those who volunteered to give access to their data for the quiz. Unfortunately, the app collected not only the quiz takers’ data but also, because of a loophole in Facebook’s system, data from the friends and family members of the quiz takers.

Thus, over 50 million Facebook users' data was exposed without consent. Although Facebook banned the sale of their data, Cambridge Analytica turned around and sold the data to be used for political consulting.

The data breach not only affected Facebook users but investors as well. In its first quarter (Q1) 2019 report, Facebook said it accrued $3 billion in legal expenses, which it claimed squeezed its operating margin by 20 percentage points and lowered its [earnings per share](https://www.investopedia.com/terms/e/eps.asp) by $1.04.

This was only the beginning; the company later faced billions in fines. The data breach also tarnished its reputation and led some users to stop using the social network website.  

## What Qualifies As PII?

Personally identifiable information is defined by the U.S. government as:

“Information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.”

## What Is Not PII?

Personal data is not classified as PII and non-personal data such as the company you work for, shared data, or anonymized data.

## What Is a PII Violation?

PII violations are illegal, and often involve frauds such as identity theft. Violations may also stem from unauthorized access, use, or disclosure of PII. Failure to report a PII breach can also be a violation.

## What Must You Do When Emailing PII?

Because email is not always secure, try to avoid emailing PII. If you must, use encryption or secure verification techniques.

## What Laws Protect PII?

Various federal and state consumer protection laws protect PII and sanction its unauthorized use—for instance, the Federal Trade Commission Act and the Privacy Act of 1974.

## The Bottom Line

Personally identifiable information (PII) is any type of data that can be used to identify someone, from their name and address to their phone number, passport information, and Social Security numbers. This information is frequently a target for identity thieves, especially over the internet. For that reason, it is essential for companies and government agencies to keep their databases secure.  

> **Article Sources**
>
> 1.  European Union. “[Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016](https://eur-lex.europa.eu/eli/reg/2016/679/oj).”
>     
> 2.  United Nations Conference on Trade and Development. “[Data Protection and Privacy Legislation Worldwide](https://unctad.org/page/data-protection-and-privacy-legislation-worldwide).”
>     
> 3.  Internal Revenue Service. “[IRS Statement on the ‘Get Transcript’ Application](https://www.irs.gov/newsroom/irs-statement-on-the-get-transcript-application).”
>     
> 4.  Experian. “[What Is Personally Identifiable Information?](https://www.experian.com/blogs/ask-experian/what-is-personally-identifiable-information/)”
>     
> 5.  National Institute of Standards and Technology, Computer Security Resource Center. “[PII](https://csrc.nist.gov/glossary/term/PII).”
>     
> 6.  European Commission. “[Data Protection in the EU](https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en).”
>     
> 7.  Office of the Australian Information Commissioner. “[History of the Privacy Act](https://www.oaic.gov.au/privacy/the-privacy-act/history-of-the-privacy-act).”
>     
> 8.  Office of the Privacy Commissioner of Canada. “[Summary of Privacy Laws in Canada: What Is Personal Information?](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/02_05_d_15/#heading-0-0-1)”
>     
> 9.  CSO. “[The Biggest Data Breach Fines, Penalties, and Settlements So Far](https://www.csoonline.com/article/567531/the-biggest-data-breach-fines-penalties-and-settlements-so-far.html).”
>     
> 10.  U.S. Securities and Exchange Commission. “[Facebook to Pay $100 Million for Misleading Investors About the Risks It Faced from Misuse of User Data](https://www.sec.gov/news/press-release/2019-140).”
>      
> 11.  Federal Trade Commission. “[FTC Issues Opinion and Order Against Cambridge Analytica for Deceiving Consumers About the Collection of Facebook Data, Compliance with EU-U.S. Privacy Shield](https://www.ftc.gov/news-events/press-releases/2019/12/ftc-issues-opinion-order-against-cambridge-analytica-deceiving).”
>      
> 12.  Federal Trade Commission. “[FTC Sues Cambridge Analytica, Settles with Former CEO and App Developer](https://www.ftc.gov/news-events/press-releases/2019/07/ftc-sues-cambridge-analytica-settles-former-ceo-app-developer).”
>      
> 13.  Meta Investor Relations. “[Facebook Reports First Quarter 2019 Results](https://investor.fb.com/investor-news/press-release-details/2019/Facebook-Reports-First-Quarter-2019-Results/default.aspx).”
>      
> 14.  Federal Trade Commission. “[FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook](https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook).”
>      
> 15.  The New York Times. “[For Many Facebook Users, a ‘Last Straw’ That Led Them to Quit](https://www.nytimes.com/2018/03/21/technology/users-abandon-facebook.html).”
>      
> 16.  U.S. Department of Commerce, Office of Privacy and Open Government, via Internet Archive Wayback Machine. “[Safeguarding Information](https://web.archive.org/web/20161115005133/https://www.osec.doc.gov/opog/privacy/PII_BII.html).”
>      
> 17.  Federal Trade Commission. “[Federal Trade Commission Act](https://www.ftc.gov/enforcement/statutes/federal-trade-commission-act).”
>      
> 18.  U.S. Department of Justice, Office of Privacy and Civil Liberties. “[Privacy Act of 1974](https://www.justice.gov/opcl/privacy-act-1974).”