PII or Just Personal? — TechKnowSurge

About this interactive

The PII lesson shows that NIST defines personally identifiable information several ways, and works through three of them. The first is the narrowest: information that identifies one specific person. Under it a rare name is PII but a common name such as Andrew is not, and a home address is PII only when one person lives there. The second is the one the lesson says to use: information that can distinguish or trace a person's identity, such as a name, a Social Security number or biometric records. A name is always PII under it, common or not, and so is a home address, however many people live there. It is the practical choice because data sets get combined, and any name might turn out to be unique. The third adds anything linked or linkable to a person, such as medical, educational, financial and employment information. The lesson finds it too broad to guide how different data is handled. So the lesson splits two kinds of data. PII identifies who you are. Personal information, PI, is about you without identifying you: a grade on a paper, a deposit, a test result. Once PI sits in a record next to a name, that record identifies you and has to be protected as PII. Laws use their own terms; GDPR's personal data covers both. A quick test for each card, taken on its own: could this lead someone to who the person is?

What you'll learn

Use the lesson's working definition of PII, where a name always counts, to decide whether a single piece of data is PII
Tell PII, which identifies a person, from personal information (PI) such as a grade, a deposit or a test result, which is about a person without identifying them

Aligned to

NIST NICE

K1194 Knowledge of Personally Identifiable Information (PII) attributes

K0917 Knowledge of Personally Identifiable Information (PII) data security standards and best practices

ISC2 CISSP

2.1 Identify and classify information and assets

Key terms

Personally Identifiable Information: Personally Identifiable Information is any data that can be used alone or in combination to identify, contact, or locate an individual, requiring protection under privacy laws and organizational security policies.
Personal Information: Data that is personal to an individual, such as medical, financial, or school records, that a person would not want disclosed publicly.
Personal Data: A term used in regulatory frameworks such as GDPR to describe any information relating to an identified or identifiable individual, encompassing both PII and other linked personal records.

Topics

Privacy Pii Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →