Personally identifiable information is data that can identify a person, either alone or when combined with other details.
Names, contact details, account numbers, and government identifiers are typical examples, and context can make more fields sensitive.
How it works
A single rare job title plus a city may identify someone even when the full name is absent.
The same field can be ordinary in one setting and identifying in another, so inventories have to look at use, not only at column titles.
Loss of this data feeds phishing, account takeover, and unwanted contact.
Protection means collecting less, limiting who can read it, and knowing where copies live.
Concrete examples
- A support ticket stores a full name, a home address, and the last four digits of a card together.
- A research export includes a device code that can be joined back to a customer table.
- A photo of a badge shows a name and an employee number that were never meant for the web.
Protective measures
- Map where identifying data is stored, including tickets, logs, and shared spreadsheets, and drop copies you do not need.
- Restrict access to people who need it for a current task and record when they read sensitive records.
- Avoid putting identifying data in analytics fields, page addresses, or messages sent to large channels.
- Tell people in plain language what you collect and why, and give them a working path to ask questions.