What Is PII?

Learn what personally identifiable information (PII) is, its categories and how to protect it, with a practice quiz.

Direct PII

Data that, on its own, uniquely and unequivocally identifies a specific person.

Why does it matter?

That single piece of data is enough to know exactly who it is.

Common examples

  • Full name
  • ID number (national ID, passport)
  • Personal email
  • Phone number
  • Bank card number
  • Full physical address

How to protect it

  • Minimize which direct data is requested and why
  • Encrypt in transit and at rest
  • Mask or truncate in screens and logs (e.g. show only the last 4 digits)
  • Control access with the principle of least privilege

General principles for protecting PII

Minimization

Collect only the data you really need for that specific purpose, nothing "just in case".

Purpose limitation

Use the data only for the purpose you told the person about when collecting it.

Retention limitation

Define how long each piece of data is kept and delete it when it's no longer needed.

Security by default

Encrypt, control access and keep audit logs from the design stage, not as a later patch.

Regulatory framework (general reference, not legal advice)

Most countries have personal data protection laws that require a legal basis to process PII and add stricter requirements for sensitive data: the GDPR in the European Union, the LGPD in Brazil, Law 1581 of 2012 (Habeas Data) in Colombia, the LFPDPPP in Mexico, or Law 25.326 in Argentina, among others. If you handle personal data, always check the specific requirements of your jurisdiction with legal counsel.