What is PII?
Personally identifiable information (PII) is information that can be used to identify, contact or locate a specific individual. Some data identifies a person on its own; other data does so only when it is combined. Because PII enables identity theft, fraud and stalking, laws, regulations and company policies control how it is collected, stored, shared and destroyed.
Examples of PII
| Direct identifiers | Indirect identifiers (identify when combined) |
|---|---|
| Full name with Social Security number | Date of birth |
| Passport or driver's license number | ZIP code |
| Biometric data such as fingerprints or face templates | Gender and race |
| Personal email address or phone number | Job title and employer |
| Home address | Device identifiers and IP addresses, depending on the regulation |
Organizations often separate sensitive PII, such as Social Security numbers, financial account numbers, medical details and biometrics, which could cause real harm if exposed, from lower-risk PII such as a business phone number listed in a public directory.
PII and related data types
- PHI (protected health information) is health data tied to a person and regulated in the US by HIPAA.
- Cardholder data, such as credit card numbers, is governed by the PCI DSS industry standard.
- Personal data under the EU's GDPR is defined broadly and includes online identifiers.
- Government-issued ID numbers are a regulated category of their own.
Handling PII correctly
- Collect only what is needed and keep it only as long as policy or law requires.
- Restrict access with role-based permissions and least privilege.
- Encrypt PII at rest, for example with BitLocker on laptops, and in transit, for example with HTTPS or encrypted email.
- Use DLP tools to detect and block PII, such as patterns that look like Social Security numbers, leaving by email, cloud upload or USB drive.
- Mask it where full values are not needed, such as showing only the last four digits.
- Dispose of it securely: shred paper, and wipe or physically destroy drives according to policy before reuse or recycling.
- Report incidents: suspected exposure of PII goes through the incident response process, because breach notification rules may apply.
PII in a technician's day
Technicians routinely handle devices full of PII. During a repair, open only the files the job requires. Collect print jobs that contain customer records promptly, or use secure print. Never copy user data to personal storage. When an old laptop or drive leaves the organization, follow the data destruction procedure and document it. Do not send PII to a caller who claims to be from IT or management until you have verified who they are.
PII on the CompTIA A+ exam
PII is on the shared A+ acronym list and is Core 2 material, where it appears with other regulated data and privacy topics.
- If a question lists name, address, birth date or SSN and asks what kind of data it is, think PII.
- If it is medical information, think PHI; if it is card numbers, think PCI DSS.
- If the question asks how to stop PII from leaving by email, think DLP; how to protect it on a lost laptop, think full-disk encryption.
- If drives that held PII are being retired, think secure wipe or physical destruction, with documentation.