PII
Personally Identifiable Information — data that can identify a specific individual, either alone or combined with other information.
PII is any information that can identify a specific person, either directly (name, government ID, phone) or in combination with other data (IP + timestamp + location may identify someone even without a name).
Definition varies by jurisdiction: - **US (broadly)**: name, SSN, driver's license, financial account numbers, biometrics. - **GDPR (EU)**: broader — includes IP addresses, cookie identifiers, location, anything that could singly or in combination identify a data subject. - **HIPAA (US healthcare)**: PHI is a specific subset covering 18 identifiers when tied to health information. - **CCPA (California)**: "personal information" is broader — includes browsing history, geolocation, inferences drawn from behavior.
Working with PII responsibly: - **Minimize collection**: don't collect PII you don't need. - **Encrypt at rest and in transit**: baseline. - **Access control**: log and limit who can see PII. - **Retention policy**: delete PII when no longer needed for its collected purpose. - **Breach response plan**: know in advance what you'd do if PII were exposed.
For AI products: pasting PII into a chat means the model provider processes it. Whether it's stored, trained on, or logged depends on the provider's terms — always relevant when the data isn't yours to share.