What Is PII? – Definition and How to Handle It
Learn what personally identifiable information covers, why direct and indirect identifiers both count, and how to handle it in collected data.
Personally identifiable information is data that identifies a person, alone or in combination with other data. That second clause is what makes the category broader than most people assume.
1. Direct and Indirect Identifiers
Direct — a name, email address, phone number, national identifier, or account username. Identifies a person on its own.
Indirect — a postcode, job title, employer, birth date, device identifier, or IP address. Identifies nobody alone and frequently does in combination.
A dataset of job titles and postcodes contains no direct identifiers and can still identify individuals where the combination is rare.
2. Why Combination Matters
Re-identification works by intersection. Three or four quasi-identifiers are often enough to single out one person in a large population.
That is why removing names is not anonymisation, and why datasets described as anonymous frequently are not.
3. Where It Appears in Collected Data
| Source | Personal data present |
|---|---|
| Business listings | Owner names, direct contact details |
| Reviews | Author names, profiles, sometimes locations |
| Job postings | Hiring manager names and contact details |
| Forums and comments | Usernames, and content revealing identity |
| Company pages | Staff names, photographs, biographies |
| Support content | Customer names in examples |
Reviews are the most commonly underestimated: the rating is a fact, and the author is a person.
4. Pseudonymisation Is Not Anonymisation
Replacing an identifier with a token reduces exposure and does not remove the data from scope, because the mapping still exists somewhere.
Genuine anonymisation means the individual cannot be re-identified by any reasonably available means — a high bar that most transformations do not meet.
5. Handling It in Collected Data
- Detect it. Scan extracted fields for names, emails, and phone patterns; the surprise is how often they appear in fields intended for something else.
- Decide deliberately whether the purpose needs it.
- Separate it, so it can be deleted without destroying the rest.
- Set shorter retention than for non-personal fields.
- Restrict access to those who need it.
- Keep provenance, so a deletion request can be answered.
- Never put it in logs, error reports, or test fixtures.
6. The Test-Data Trap
Copying production data into development or test environments spreads personal data into systems with weaker controls and longer retention.
Synthetic or properly anonymised fixtures avoid it. This is one of the most common ways collected personal data ends up somewhere nobody intended.
7. Special Categories Deserve More Care
Health, biometric, religious, political, sexual-orientation, and trade-union data attract stricter treatment in most frameworks.
Collected web data can contain these incidentally — a forum post revealing a health condition, a listing revealing religious affiliation — and incidental collection does not lower the obligations.
8. Summary
Personally identifiable information includes both direct identifiers and indirect ones that identify in combination, which makes the category wider than names and emails.
In collected data it appears in reviews, listings, job postings, and comments. Detect it, keep it separable with shorter retention, restrict access, keep it out of logs and test fixtures, and remember that removing names is not anonymisation.