TL;DR: PII stands for personally identifiable information: anything that can identify you, either on its own (your name, Social Security or passport number) or when combined with other details (date of birth, ZIP code, employer). US agencies use the term; the UK and EU use “personal data,” which is broader and includes things like location data and online identifiers. PII is what identity thieves collect, so knowing which pieces of yours are exposed is the first step to protecting them.
The official definition
The US National Institute of Standards and Technology (NIST) defines PII as “information that can be used to distinguish or trace an individual's identity, either alone” or when combined with other information that is linked or linkable to that person. That “linkable” part is the key idea: harmless-looking details become identifying when joined together.
Examples of PII
Direct identifiers (identify you on their own)
- Full name in context, Social Security number, passport, driver's licence or national ID number
- Personal phone number and email address
- Bank account and card numbers
- Biometrics such as fingerprints or face scans
Linkable or indirect identifiers (identify you in combination)
- Date of birth, place of birth, ZIP or postcode
- Employer, job title, school
- IP address, device IDs, precise location history
- Photos, usernames, vehicle registration
NIST's own guidance (SP 800-122) also counts medical, educational, financial and employment records linked to a person.
PII vs “personal data” (UK and EU)
Under the UK and EU GDPR, the term is personal data: “any information relating to an identified or identifiable natural person,” as the ICO explains. It explicitly includes names, ID numbers, location data and online identifiers. Some categories get extra protection as “special category data,” including health, biometric and genetic data, religious beliefs and political opinions.
In practice, personal data is the wider net. Something like a cookie ID might not be PII in a US policy, but is usually personal data in Europe. If you're in the UK or EU, you can ask any company what personal data it holds with a subject access request.
Sensitive PII: the pieces that do the most damage
Some PII is far more dangerous when leaked. A government ID number plus date of birth can open loans; a phone number plus email lets scammers impersonate your bank convincingly. Our breakdown of what a data breach actually exposes ranks each type by risk, and the average cost of identity theft shows what happens when it goes wrong.
Where your PII leaks from
- Data breaches at companies you used years ago.
- Data brokers and people-search sites that compile public records. See who sells your data.
- Your own posts, including hidden metadata in photos and files.
- Forms and apps that ask for more than they need.
How to protect your PII
- Give out the minimum. Ask why a form needs your ID number or date of birth.
- Use an email alias or masked number for sign-ups.
- Freeze your credit if you're in the US, and turn on two-factor authentication.
- Find out what is already out there and remove what you can.
Step four is where most people start. A free email exposure check shows which breaches your email appears in, and the full Scan My Shadow scan adds your phone number.
Frequently Asked Questions
What does PII stand for?
Personally identifiable information: information that can identify a specific person, either alone or combined with other linked details.
What is considered PII?
Direct identifiers such as name, Social Security or passport number, phone number and email, plus linkable details such as date of birth, postcode, employer, IP address and photos when combined.
Is an email address PII?
Yes. A personal email address can identify you and is commonly treated as PII, and as personal data under GDPR.
What is the difference between PII and personal data?
PII is mainly a US term. Personal data under UK and EU GDPR is broader, covering any information relating to an identifiable person, including location data and online identifiers.
What is sensitive PII?
PII that can cause serious harm if exposed, such as government ID numbers, financial account numbers, biometrics and medical information.