What is PII?

Personally identifiable information (PII) is defined in NIST Special Publication 800-122 as any information an organization gathers, stores, or processes that can independently identify—or be combined with additional information to determine, trace, or distinguish the identity of—a specific individual. This type of information includes names, Social Security numbers, biometric records, dates and places of birth, mothers' maiden names, etc.

Regardless of the regulation or compliance mandates being considered, PII is sometimes used more broadly to refer to all types of identifying personal information—similar to how PCI can be shorthand for cardholder data. PII is particularly valuable to cybercriminals because it can be used to commit fraud by impersonating those whom the data identifies, making the consequences of compromised PII significantly more expensive and debilitating than losing a credit card PAN.