We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Data Governance & Compliance
Personally Identifiable Information: any data that can identify a specific individual, like name, email, SSN, or IP address. Must be encrypted and access-controlled.
In short
PII (Personally Identifiable Information) is any data that can be used to identify a specific person, either on its own or when combined with other data. It includes direct identifiers like full name, Social Security number, passport number, and email address, plus indirect ones like IP address, device ID, and date of birth, and systems must encrypt it, restrict who can read it, and track where it flows.
In short
PII (Personally Identifiable Information) is any data that can be used to identify a specific person, either on its own or when combined with other data. It includes direct identifiers like full name, Social Security number, passport number, and email address, plus indirect ones like IP address, device ID, and date of birth, and systems must encrypt it, restrict who can read it, and track where it flows.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers PII across a run of lessons, not one page. These 4 alone are about 87 minutes of step-by-step reading, every one with a quiz.
Identify, classify, protect, and manage Personally Identifiable Information across your entire system.
Hide sensitive data while preserving its format and usability, the art of showing enough without showing too much.
A dedicated physical network link between your data center and AWS, bypassing the internet entirely.
Alert via email, when to use it and how to avoid alert fatigue.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with PII Handlingpay once,
yours for life
PII is the subset of your data that points back to a real human. Regulators split it into two buckets. Direct identifiers single out a person by themselves: a Social Security number, a passport number, a credit card number, a full name plus address. Indirect identifiers do not identify anyone alone but become identifying when you join enough of them together: a ZIP code, a birth date, a gender, a browser fingerprint.
The classic result that engineers should know: Latanya Sweeney showed that 87 percent of the US population is uniquely identifiable from just ZIP code, date of birth, and sex. None of those three feels like PII on its own. Combined, they are. This is why you cannot decide sensitivity field by field in isolation.
Different laws draw the line in different places. GDPR uses the broader term personal data and explicitly counts IP addresses, cookie IDs, and location data. The US HIPAA rule lists 18 specific identifiers for health data. CCPA in California covers households, not just individuals. If you build for a global audience you design to the strictest definition, which is usually GDPR.
The first technique is encryption in two states. At rest, PII columns or whole disks are encrypted with AES-256 so a stolen backup or disk is useless without the key. In transit, everything moves over TLS 1.2 or 1.3 so it cannot be read off the wire. Keys live in a dedicated key manager like AWS KMS or HashiCorp Vault, never next to the data they protect.
The second technique is reducing exposure of the raw value. Tokenization swaps a credit card number for a random token and keeps the real value in a separate hardened vault, which is how payment processors keep most of their systems out of PCI scope. Masking shows only the last 4 digits in logs and UIs. Hashing with a salt lets you match or deduplicate without storing the plaintext.
The third technique is access control and auditing. PII tables sit behind role-based access so a support agent sees a masked email while a fraud analyst with a logged reason sees the full record. Every read and write is recorded in an audit log. On top of that, retention jobs delete records after a defined period and honor deletion requests, because the safest PII is the PII you no longer store.
You treat data as PII the moment it can be traced to a person, even indirectly, and the cost of getting this wrong is real. GDPR fines reach 20 million euros or 4 percent of global annual revenue, whichever is larger. Equifax paid roughly 700 million dollars after leaking PII on about 147 million people in 2017.
The trade-off is that protection slows you down and limits what you can do with the data. Encrypted columns are harder to index and search. Tokenized fields break joins unless you detokenize, which adds latency and a network hop. Strict access control creates friction for analysts and on-call engineers. Anonymization for analytics removes value, and weak anonymization can be reversed, as Netflix learned when researchers re-identified users in its supposedly anonymous 2006 prize dataset.
A practical middle ground is data minimization plus pseudonymization. Collect only the fields you truly need, replace identifiers with stable pseudonyms in your analytics pipeline, and keep the mapping back to real identity in one tightly controlled service. You get useful data without spreading raw PII across every system.
Picture a checkout flow. The user submits name, email, shipping address, and card number over TLS. Your API never stores the card. It sends the number straight to Stripe, which returns a token, and you save only the token plus the last 4 digits for display.
The name, email, and address go into a users table where those columns are encrypted at rest with a KMS-managed key. Application logs scrub the email down to a masked form so a leaked log file does not leak inboxes. A nightly job pseudonymizes the order data before it lands in the analytics warehouse, so the BI team can count orders by region without ever seeing a real name.
When that user later clicks delete my account, a workflow removes their row, revokes the Stripe token, and writes a tombstone record proving the deletion happened. That single flow shows every layer working together: minimize, tokenize, encrypt, mask, pseudonymize, audit, and delete on request.
Stripe
Tokenizes card numbers so merchants store a token instead of raw PAN data, keeping most of their systems out of PCI DSS scope.
AWS Key Management Service
Manages the encryption keys used to encrypt PII columns and S3 objects at rest with AES-256.
HashiCorp Vault
Stores secrets and runs transit and tokenization engines so applications encrypt PII without ever holding the keys.
Apple
Uses on-device processing and differential privacy so usage patterns can be analyzed without sending identifiable data to its servers.
Under GDPR, yes. The EU Court of Justice ruled that a dynamic IP address is personal data because an internet provider can link it back to a subscriber. US law is less consistent, so if you serve EU users you should treat IP addresses as PII and avoid logging them in the clear.
PII is any data that identifies a person. Sensitive personal data is a stricter subcategory that needs extra protection, including health records, biometrics, race, religion, sexual orientation, and political views. GDPR calls this special category data and bans processing it without explicit consent or a specific legal basis.
Not fully. A plain hash of a low-entropy value like an email or phone number can be reversed with a precomputed lookup table because the input space is small. Always add a secret salt or use keyed hashing, and remember that under GDPR a reversible pseudonym is still personal data, not anonymous data.
Anonymization removes identity permanently so no one can trace the data back to a person, which takes it outside privacy law. Pseudonymization swaps identifiers for tokens but keeps a mapping that can re-link them, so it is still regulated PII. True anonymization is hard and naive attempts are often reversible.
Only as long as you have a documented purpose for it. Laws like GDPR and CCPA require a defined retention period and the ability to delete data on request. The practical rule is to set per-field retention windows, run automatic deletion jobs, and collect the minimum you need in the first place.
Data Masking
Hide sensitive data while preserving its format and usability, the art of showing enough without showing too much
PII and Compliance for LLM Apps: Redaction, Retention, and Data Boundaries
A prompt to an LLM provider is a data export. Redact PII before it reaches the model and your logs, bound retention, and honor deletion across every store.
LLM Guardrails and Safety: Wrapping the Model So It Can Ship
Why raw LLM output is a production risk, and how input and output guardrails wrap the model to catch injection, PII leaks, toxicity, and hallucination
GDPR
General Data Protection Regulation: EU law governing how personal data is collected, stored, and processed. Requires consent, data portability, and the right to be forgotten.
Data Encryption
Transforming data into an unreadable format using cryptographic algorithms. Encryption at rest protects stored data; encryption in transit protects data over the network.
Data Masking
Replacing sensitive data with realistic but fake values so developers and testers can work with production-like data without exposing real PII.
Data Lineage
Tracking data from its origin through every transformation and system it passes through. Answers 'where did this number come from?' for audits and debugging.
Data Catalog
A searchable inventory of all datasets in an organization, with metadata like schema, owner, freshness, and lineage. The 'Google for your data.'
This page explains the idea. The "PII Handling" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the PII Handling lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about PII in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
