Glossary›AI and Data Readiness›Personally identifiable information (PII)

Personally identifiable information (PII)

What are examples of PII?

Information that identifies a person, on its own or combined with other data. Examples include full names with home addresses, Social Security or passport numbers, dates of birth, personal email addresses and phone numbers, bank account numbers, medical record numbers, and photos or recordings of a person’s face or voice.

Is an email address PII?

In most cases, yes. A work or personal email address usually points to one person, so privacy laws such as GDPR treat it as personal data. A shared address for a team or a general inbox usually is not, because it does not identify an individual.

What is the difference between PII and sensitive data?

PII is one kind of sensitive data. PII is information that identifies a person, such as a name with an address or an ID number. Sensitive data is the wider group of anything that would cause harm if exposed: PII, but also health records, financial details, contracts, trade secrets, source code, and unreleased designs or media. All PII is sensitive, but not all sensitive data is about a person.

Which industries handle the most PII?

Every organization holds some, at least in its employee and customer records, but a few industries hold far more: healthcare, financial services, insurance, retail and ecommerce, education, and government. In those industries, PII sits not only in databases but also in scans, exports, recordings, and documents spread across file storage.

Are there laws and regulations about PII?

Yes, many, and they differ by country, state, and industry. The best known include GDPR in the European Union, the California Consumer Privacy Act and other state privacy laws in the United States, and industry rules such as HIPAA for health data. Every US state also has a breach notification law, which requires telling people when their personal information is exposed. Most of these laws expect an organization to know where personal data is stored, keep it only as long as needed, and protect it.

How do you keep sensitive files out of an AI pipeline?

Identify likely-sensitive files from metadata signals, such as name, path, format, and location, and exclude them at selection. Because the check happens on the description rather than the content, it runs at the speed of the index and works in environments where reading file contents is not permitted.

What is shadow AI?

Shadow AI is the use of AI tools inside an organization without approval or oversight, such as staff pasting documents into a public chatbot or a team connecting an AI service to a shared drive. The risk is that sensitive files, including personal data, leave controlled storage without a record. Knowing where sensitive files sit is the starting point for setting rules around AI use.

Does metadata indexing read PII?

It does not read the contents of files, so the PII inside documents, spreadsheets, and scans is not copied into the index. Metadata can still contain personal information, though: file names such as a person’s name with “passport,” folder paths named after employees or patients, and owner names. That is why access to a metadata catalog should be protected, and why metadata is a useful first signal of where PII is likely to sit before content scanning tools confirm it.

Is PII often targeted by ransomware?

Yes. Many ransomware groups now steal data before they encrypt it, then threaten to publish it, and personal data is the most useful to them because exposing it brings legal notification duties, fines, and damage to trust. Sophos found that the average cost of recovering from a ransomware attack is $1.7 million, not counting the ransom. Knowing where PII sits, keeping less of it, and limiting who can reach it all reduce what an attacker can take.

← Back to AI and Data Readiness

Last updated: November 13, 2026.