Personally identifiable information (PII)

Personally identifiable information, PII, is any data that can identify a specific individual, either on its own (a name, a passport number, an email address) or in combination with other data (a birth date plus a ZIP code plus a gender is often enough to identify someone uniquely). What counts as PII is not fully standardized: General Data Protection Regulation uses the broader term "personal data" and covers anything relating to an identifiable person, including online identifiers like device IDs, while other frameworks draw the line more narrowly around directly identifying fields.

Because the definition is context-dependent, most organizations maintain a data classification scheme that tags fields as PII, sensitive, or public, so handling rules can be applied automatically rather than judged case by case. Common protections applied to PII include anonymization, pseudonymization, and data masking, each of which reduces identifiability differently and offers a different level of protection and reversibility.

PII matters in analytics because it drives what data can be collected, how long it can be kept, and who can query it, an issue covered separately under California Consumer Privacy Act in the U.S. Analysts sometimes assume dropping an obvious field like name removes PII entirely; combinations of "non-identifying" fields can still re-identify someone, which is why classification, not intuition, should determine what's safe to use. This is general context, not legal advice.