Personally Identifiable Information

PII is data that can identify a specific person, alone or combined with other records. Handling direct and quasi-identifiers correctly drives privacy design.

security

Definition

Personally identifiable information (PII) is any data that can be used to distinguish or trace an individual's identity, either directly through a name, email address, or government ID, or indirectly when combined with other data such as birth date, postcode, or device identifiers.

Context and scope

Privacy laws define PII and personal data differently, but engineering practice converges on classification, minimization, and controlled access. PII appears in databases, logs, analytics events, backups, and support tickets.

Common misconceptions

PII means only names and government identification numbers
Hashing an email address makes the data anonymous
A field is safe to log as long as nobody labeled it PII

Anti-patterns

Copying production PII into development or test environments
Logging full request bodies that may contain personal data
Using unsalted hashes of low-entropy identifiers such as phone numbers

Related concepts

Related examples

Authoritative source

https://csrc.nist.gov/glossary/term/personally_identifiable_information

Direct and indirect identifiers

Direct identifiers point to one person: name, email address, phone number, government ID, passport number. Indirect or quasi-identifiers narrow a population: birth date, postcode, gender, job title, device ID. Combining several quasi-identifiers can re-identify people even after names are removed. A 1997 study by Latanya Sweeney showed that postcode, gender, and birth date uniquely identified about 87 percent of the US population.

How to handle it

Classify fields, then minimize: collect only what the feature needs, restrict access, encrypt at rest and in transit, and keep PII out of logs, analytics, and test environments. Pseudonymization replaces identifiers with tokens; it reduces exposure but is not anonymization when the mapping or underlying data can be re-linked.

// Redact before logging: keep the domain, drop the local part
const maskEmail = (email: string) => email.replace(/^[^@]+/, '***');
maskEmail('[email protected]'); // '***@example.com'

Hashing low-entropy identifiers such as phone numbers without a secret salt is reversible by enumeration, so use keyed hashing with a managed key.

When to use it

Apply the classification whenever data enters a new system: production tables, logs, warehouses, backups, support tickets, and third-party integrations. It matters most for analytics and debugging workflows, where copies of production data tend to accumulate quietly.

Trade-offs

Minimization reduces risk but can limit analytics and support quality. Encryption protects storage but does not stop an authorized application from reading fields. Retention limits exposure but complicates investigations and legal holds. Pseudonymization preserves joins within a dataset while still counting as personal data under many regimes.

PII is not limited to names and national IDs, and removing a name does not anonymize a record. A field is not safe to log merely because nobody labeled it PII. Related concepts include Encryption at Rest, Data Retention, Audit Logging, and Least Privilege.