PII or Just PI?

Personal Information (PI) and Personally Identifiable Information (PII) sound almost the same, and that is exactly why they get mixed up. PI is anything personal to you that you would not want out: medical, school and financial details, what you buy, what you browse. PII is a type of PI that goes one step further and actually identifies you, so it can zero in on a single person. This drill shows one piece of data at a time and asks one question about it: could this point to one specific person? If the answer is yes, it is PII. Some data does that alone, like a Social Security number, a passport number, or a personal phone number or email address that reaches one individual. Other data does it in combination: a name with a home address, a name with a date of birth. The definition of PII says alone or in combination, and that clause is where the first trap lives. A zip code, a birth date and a gender each look harmless, but stored together they narrow thousands of people down to very few, often one. A job title of Chief Financial Officer means nothing until you add the company's name, and then it means one person. An employee ID number carries no name, but the HR system links it to exactly one staff member. The second trap runs the other way. A diagnosis, a low credit score, a salary figure or an anonymous answer about anxiety all feel intensely private, and they are personal information worth protecting. But how sensitive something feels is not the test. With no name, account or record attached to say whose it is, none of them can point to anyone, so they stay PI. Watch for the pairs: the same asthma diagnosis or the same salary is PI on its own and becomes PII the moment a name is printed next to it. Sort by asking whether the data leads to one specific person, not by how much you would mind it getting out.