What Is PII? Personally Identifiable Information Explained

PII is any information that can identify you, on its own or when combined with other details. Knowing what counts helps you decide what to share.

By Siddharth ShankarUpdated October 18, 2026

PII is a term used by governments, companies and privacy laws to describe information about people. You see it in privacy policies, breach notices and security training. In plain words, it is anything that points to you.

The official definition

The US National Institute of Standards and Technology (NIST) defines PII as information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to that person. Its examples include name, Social Security number and biometric records.

The key idea is combination. Your first name alone may not identify you. Your first name plus your street, employer and birthday almost certainly does.

Examples of PII

• Direct identifiers: full name, Social Security or national ID number, passport and driver’s licence numbers, biometric data such as fingerprints and face scans.
• Contact details: email address, phone number, home address.
• Linkable details: date of birth, place of birth, employer, school, IP address, device IDs, photos, usernames.
• Linked records: medical, financial, education and employment information tied to you.

Sensitive and non-sensitive PII

Not all PII carries the same risk. A useful way to think about it:

• High risk: government ID numbers, bank and card numbers, passwords, biometrics and medical details. A leak can lead to fraud or identity theft. See what each type of breached data means.
• Medium risk: date of birth, home address and phone number. Alone they cause limited harm, but they help criminals pass security checks and target scams.
• Lower risk on their own: your name, city or job title. These matter mainly when combined with other details.

PII outside the US

Europe and the UK use the term personal data, which is broader than PII. The UK regulator, the ICO, notes that the UK GDPR specifically includes online identifiers, listing examples such as IP addresses and cookie identifiers, even when you are not named. In practice, data protection laws in many countries cover more than the US idea of PII.

Where your PII ends up

Most people have PII spread across many places: accounts, shops, public records, people-search sites, data brokers and old breaches. See what strangers can find about you online and what data brokers collect.

How to protect your PII

Why combinations matter most

Many identity scams do not need your SSN. A name, date of birth, address and phone number can be enough to pass basic security checks or to make a phishing message believable. That is why reducing the small details matters as much as protecting the big ones.

PII in everyday life

Think about how often you hand over PII without noticing: a delivery form, a coffee shop Wi-Fi sign-in, a contest entry, a loyalty card. Each one is reasonable on its own. Together they create a detailed profile that can be sold, breached or matched by data brokers. Good privacy habits are less about secrecy and more about not leaving extra copies of yourself in places you will forget.