What is PII (personally identifiable information)?

PII, short for personally identifiable information, is information that can be used to identify a particular person, either on its own or combined with other information. It is a US term; UK and EU law use the broader term "personal data".

The US definition

In the US, a widely cited definition comes from NIST. The NIST glossary defines it as:

"Any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information."

NIST's SP 800-122 gives guidance on protecting the confidentiality of PII.

PII versus personal data

If you work under the UK GDPR or EU GDPR, the term that matters is personal data. Article 4(1) defines it as "any information relating to an identified or identifiable natural person". A person can be identified directly or indirectly, including through location data, an online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

That is broader than most uses of PII. It expressly includes online identifiers and indirect identification, where pieces of information only identify someone when put together. Treat "PII" and "personal data" as related but not interchangeable. If UK or EU law applies, use the personal data test. See UK GDPR and EU GDPR for more.

Examples

Financial data such as bank account numbers, IBANs and payment card numbers sits between these. It identifies an account, and often the person who holds it.

How DOCNUS detects PII

The privacy assessment in DOCNUS, on Professional and Enterprise plans, looks for 50 categories of personal data in 13 groups, from identity and contact details through government IDs, financial and online identifiers to health, belief, origin, sexuality, criminal justice, employment and special status (minors and vulnerable adults).

It uses two layers:

1. Deterministic checks. Pattern matching followed by checksum or format validation for identifiers such as UK National Insurance numbers, NHS numbers, UTRs, IBANs, payment cards (Luhn check), US SSNs, EU VAT numbers and national IDs from many countries, plus emails, phone numbers and IP addresses.
2. An AI model. It reads the document for names, addresses and sensitive information written in prose, such as a health condition mentioned in a letter.

To see the first layer on your own text, paste it into the free Personal Data Checker. It needs no account and stores nothing.

Each finding records which layer found it, the page, and a masked value such as j***@***.uk. The raw value is not stored in the findings. Read why we never store the value we found.

Detection is not perfect. Review findings against the cited pages, and treat the result as an automated risk assessment rather than legal advice.