PII
Personally Identifiable Information: any data that can identify a specific individual, like name, email, SSN, or IP address. Must be encrypted and access-controlled.
What is PII?
In short
PII (Personally Identifiable Information) is any data that can be used to identify a specific person, either on its own or when combined with other data. It includes direct identifiers like full name, Social Security number, passport number, and email address, plus indirect ones like IP address, device ID, and date of birth, and systems must encrypt it, restrict who can read it, and track where it flows.
What PII actually means
PII is the subset of your data that points back to a real human. Regulators split it into two buckets. Direct identifiers single out a person by themselves: a Social Security number, a passport number, a credit card number, a full name plus address. Indirect identifiers do not identify anyone alone but become identifying when you join enough of them together: a ZIP code, a birth date, a gender, a browser fingerprint.
The classic result that engineers should know: Latanya Sweeney showed that 87 percent of the US population is uniquely identifiable from just ZIP code, date of birth, and sex. None of those three feels like PII on its own. Combined, they are. This is why you cannot decide sensitivity field by field in isolation.
Different laws draw the line in different places. GDPR uses the broader term personal data and explicitly counts IP addresses, cookie IDs, and location data. The US HIPAA rule lists 18 specific identifiers for health data. CCPA in California covers households, not just individuals. If you build for a global audience you design to the strictest definition, which is usually GDPR.
How systems protect it under the hood
The first technique is encryption in two states. At rest, PII columns or whole disks are encrypted with AES-256 so a stolen backup or disk is useless without the key. In transit, everything moves over TLS 1.2 or 1.3 so it cannot be read off the wire. Keys live in a dedicated key manager like AWS KMS or HashiCorp Vault, never next to the data they protect.
The second technique is reducing exposure of the raw value. Tokenization swaps a credit card number for a random token and keeps the real value in a separate hardened vault, which is how payment processors keep most of their systems out of PCI scope. Masking shows only the last 4 digits in logs and UIs. Hashing with a salt lets you match or deduplicate without storing the plaintext.
The third technique is access control and auditing. PII tables sit behind role-based access so a support agent sees a masked email while a fraud analyst with a logged reason sees the full record. Every read and write is recorded in an audit log. On top of that, retention jobs delete records after a defined period and honor deletion requests, because the safest PII is the PII you no longer store.
When it matters and the trade-offs
You treat data as PII the moment it can be traced to a person, even indirectly, and the cost of getting this wrong is real. GDPR fines reach 20 million euros or 4 percent of global annual revenue, whichever is larger. Equifax paid roughly 700 million dollars after leaking PII on about 147 million people in 2017.
The trade-off is that protection slows you down and limits what you can do with the data. Encrypted columns are harder to index and search. Tokenized fields break joins unless you detokenize, which adds latency and a network hop. Strict access control creates friction for analysts and on-call engineers. Anonymization for analytics removes value, and weak anonymization can be reversed, as Netflix learned when researchers re-identified users in its supposedly anonymous 2006 prize dataset.
A practical middle ground is data minimization plus pseudonymization. Collect only the fields you truly need, replace identifiers with stable pseudonyms in your analytics pipeline, and keep the mapping back to real identity in one tightly controlled service. You get useful data without spreading raw PII across every system.
A concrete example
Picture a checkout flow. The user submits name, email, shipping address, and card number over TLS. Your API never stores the card. It sends the number straight to Stripe, which returns a token, and you save only the token plus the last 4 digits for display.
The name, email, and address go into a users table where those columns are encrypted at rest with a KMS-managed key. Application logs scrub the email down to a masked form so a leaked log file does not leak inboxes. A nightly job pseudonymizes the order data before it lands in the analytics warehouse, so the BI team can count orders by region without ever seeing a real name.
When that user later clicks delete my account, a workflow removes their row, revokes the Stripe token, and writes a tombstone record proving the deletion happened. That single flow shows every layer working together: minimize, tokenize, encrypt, mask, pseudonymize, audit, and delete on request.
Where it is used in production
Stripe
Tokenizes card numbers so merchants store a token instead of raw PAN data, keeping most of their systems out of PCI DSS scope.
AWS Key Management Service
Manages the encryption keys used to encrypt PII columns and S3 objects at rest with AES-256.
HashiCorp Vault
Stores secrets and runs transit and tokenization engines so applications encrypt PII without ever holding the keys.
Apple
Uses on-device processing and differential privacy so usage patterns can be analyzed without sending identifiable data to its servers.
Frequently asked questions
- Is an IP address considered PII?
- Under GDPR, yes. The EU Court of Justice ruled that a dynamic IP address is personal data because an internet provider can link it back to a subscriber. US law is less consistent, so if you serve EU users you should treat IP addresses as PII and avoid logging them in the clear.
- What is the difference between PII and sensitive personal data?
- PII is any data that identifies a person. Sensitive personal data is a stricter subcategory that needs extra protection, including health records, biometrics, race, religion, sexual orientation, and political views. GDPR calls this special category data and bans processing it without explicit consent or a specific legal basis.
- Does hashing PII make it safe to store?
- Not fully. A plain hash of a low-entropy value like an email or phone number can be reversed with a precomputed lookup table because the input space is small. Always add a secret salt or use keyed hashing, and remember that under GDPR a reversible pseudonym is still personal data, not anonymous data.
- What is the difference between anonymization and pseudonymization?
- Anonymization removes identity permanently so no one can trace the data back to a person, which takes it outside privacy law. Pseudonymization swaps identifiers for tokens but keeps a mapping that can re-link them, so it is still regulated PII. True anonymization is hard and naive attempts are often reversible.
- How long can you keep PII?
- Only as long as you have a documented purpose for it. Laws like GDPR and CCPA require a defined retention period and the ability to delete data on request. The practical rule is to set per-field retention windows, run automatic deletion jobs, and collect the minimum you need in the first place.
Learn PII hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
Related lessons
Lessons that touch on PII as part of a larger topic.
PII Handling
Identify, classify, protect, and manage Personally Identifiable Information across your entire system
intermediate · data governance compliance
Data Masking
Hide sensitive data while preserving its format and usability, the art of showing enough without showing too much
intermediate · data governance compliance
PII and Compliance for LLM Apps: Redaction, Retention, and Data Boundaries
A prompt to an LLM provider is a data export. Redact PII before it reaches the model and your logs, bound retention, and honor deletion across every store.
ml-advanced · security
LLM Guardrails and Safety: Wrapping the Model So It Can Ship
Why raw LLM output is a production risk, and how input and output guardrails wrap the model to catch injection, PII leaks, toxicity, and hallucination
ml-advanced · llm genai ops
See also
Related glossary terms you might want to look up next.
GDPR
General Data Protection Regulation: EU law governing how personal data is collected, stored, and processed. Requires consent, data portability, and the right to be forgotten.
Data Encryption
Transforming data into an unreadable format using cryptographic algorithms. Encryption at rest protects stored data; encryption in transit protects data over the network.
Data Masking
Replacing sensitive data with realistic but fake values so developers and testers can work with production-like data without exposing real PII.
Data Lineage
Tracking data from its origin through every transformation and system it passes through. Answers 'where did this number come from?' for audits and debugging.
Data Catalog
A searchable inventory of all datasets in an organization, with metadata like schema, owner, freshness, and lineage. The 'Google for your data.'