What is Personally Identifiable Information (PII)?

Personally identifiable information (PII) is any data that identifies a specific person, either on its own or when combined with other available information. Names, government ID numbers, addresses, and biometric records are the obvious examples. The category reaches considerably further than most organizations assume, and that gap is where exposure hides.

One recent case shows how quickly the abstract becomes concrete. CloudSEK's supply chain research traced a single misconfigured .git folder at an Indian automotive services vendor to more than a million exposed PII records. That haul included over 2,000 scanned PAN cards alongside customer names, addresses, and phone numbers.

What Is Personally Identifiable Information (PII)?

PII is information that identifies an individual, whether by itself or in combination with other data an attacker already holds. NIST's guide to protecting PII puts it precisely: information that distinguishes or traces an individual's identity, plus any other information linked or linkable to that person.

Both verbs in that definition earn their place. Distinguishing someone means pinpointing exactly who they are, the way a passport number does. Tracing means assembling enough detail to establish what a person did or where they were, the way an access log does.

Linked and linkable draw an equally careful line. Linked information sits beside other data about the same person in a connected system. Linkable information waits somewhere else, in public records or an unrelated database, one join away from completing the picture.

Direct and Indirect Identifiers

Identifiers separate into two groups, and the second group causes most of the misjudgement.

• Direct identifiers. Full name, Identity card number (Aadhaar Card), PAN, Social Security number, passport number, driving licence number, and biometrics such as fingerprints or facial scans. Each points to one person without help.
• Indirect identifiers. Date of birth, postal code, gender, employer, job title, vehicle registration, and purchase history. Each describes a crowd, until several are put together.

Sensitive vs Non-Sensitive PII

Among PII, some data causes serious harm if exposed, and some does not, and the split decides how strictly each item is protected. Sensitive PII identifies a person directly and enables fraud or discrimination; non-sensitive PII is often public and dangerous mainly in combination.

Context flips items between columns. A full name is non-sensitive in isolation, and the same name on a list of a specific hospital's patients becomes sensitive. Strong programs classify by the harm exposure would cause in context, not by the field label alone.

Examples of PII by Category

PII spans six broad categories, and recognizing every category is the first step in protecting them.

• Government identifiers: Social Security, passport, driver's license, and tax identification numbers.
• Financial data: Bank account numbers, credit and debit card numbers, and payment records.
• Biometric data: Fingerprints, facial geometry, retinal scans, and voiceprints.
• Contact details: Full name, home address, email address, and phone number.
• Digital identifiers: IP address, device IDs, cookies, and account usernames tied to a person.
• Demographic details: Date of birth, gender, ZIP code, ethnicity, and employment information.

Why Non-Sensitive PII Still Identifies People

Stripping names out of a dataset feels like anonymization. It seldom is.

Latanya Sweeney's analysis of US census data found that 87% of the population was uniquely identifiable from three fields alone: five-digit ZIP code, gender, and date of birth. At the city level, the figure held at 53%, and even at the county level, 18% of people remained unique.

Combination, not technical sophistication, does the work here. Each attribute on its own describes millions of people, yet their intersection often describes exactly one, and a voter roll or marketing list supplies the name that finishes the job.

How Context Changes PII Risk

Identical fields carry wildly different risk depending on whom they describe. NIST rates each holding of PII at a low, moderate, or high confidentiality impact level, weighing how precisely the data identifies someone, how many people it covers, how sensitive each field is, and the purpose behind collecting it.

Picture three lists built on exactly the same schema: name, address, and phone number. One holds newsletter subscribers. Another holds people claiming retirement benefits. A third holds officers working undercover in law enforcement.

Same three columns, three entirely different outcomes if they leak. Context sets the protection a dataset needs, which is why a field-by-field checklist rarely captures real exposure.

PII vs Personal Data vs PHI

Three terms circulate as if interchangeable and carry distinct legal meanings.

PII comes from US federal guidance and centres on identifying a specific individual. Personal data, the GDPR term, casts a wider net: any information relating to an identified or identifiable natural person, including online identifiers and pseudonymised records where a separate key still leads back to someone.

Protected health information (PHI) narrows the frame again. HIPAA applies it to health data held by covered entities such as hospitals and insurers, so an identical blood test result counts as PHI inside a hospital system and as ordinary personal data inside a consumer fitness app. India's DPDP Act adopts the phrase personal data, aligning its vocabulary with GDPR rather than US practice.

How PII Gets Exposed

Four routes account for most large-scale PII exposure, and only one of them looks like a classic breach.

1. Infostealer malware

Infostealer malware harvests saved browser credentials, autofill records, and authentication tokens from an infected machine, then packages them into logs sold in bulk. A single compromised laptop hands over the personal data of everyone whose records that employee touched.

2. Misconfigured repositories and storage

Exposed .git directories, public cloud storage buckets, and unauthenticated databases leak data without any intrusion at all. CloudSEK's automotive vendor case began exactly this way: a routine scan found a publicly reachable .git folder, and a freely available tool rebuilt the source code and the customer records behind it.

3. Third-party and vendor compromise

Vendors process customer PII on behalf of the businesses that hire them, which places a company's exposure outside its own controls. Payment processors, logistics partners, marketing platforms, and support desks each hold copies of records the original organization no longer governs directly.

4. Dark web aggregation

What follows a leak matters more than the leak itself. Brokers merge records from separate incidents into consolidated profiles, so a phone number from one breach joins an address from another and an ID number from a third. Continuous dark web monitoring surfaces these listings while the data is still being traded rather than after it is used.

What Attackers Do With Stolen PII

Whoever steals a database rarely exploits it personally. Records get sold, merged, and reused, in five recurring ways:

• Identity theft and document forgery. Scanned Aadhaar cards, PAN cards, and passports support fraudulent accounts, loan applications, and forged credentials.
• Account takeover. Names, email addresses, and phone numbers feed credential-stuffing runs and SIM-swap attacks that defeat SMS-based authentication.
• Targeted phishing. Genuine order details, addresses, and vendor relationships make a fraudulent message nearly indistinguishable from a real one.
• Extortion. Ransomware groups threaten to publish customer records, converting a quiet theft into public leverage over the breached organization.
• Resale and aggregation. Brokers repackage records into combined profiles and sell them repeatedly, so one leak keeps producing harm for years.

Pricing reveals how little this data costs to acquire. CloudSEK's investigation into the BWSSB breach found root database access and the records of more than 290,000 applicants, Aadhaar and PAN numbers included, advertised on a breach forum for $500, with the seller open to negotiating lower.

Laws That Govern PII

Obligations follow the people described, not the company's headquarters. Four frameworks carry the most weight:

• GDPR (European Union). Governs the personal data of anyone in the EU and reaches organizations worldwide that serve them.
• CCPA and CPRA (California). Grant residents rights to know what is collected about them, delete it, and opt out of its sale.
• HIPAA (United States). Covers health information held by providers, insurers, and their business associates.
• DPDP Act (India). Applies to digital personal data of people in India, including processing by foreign companies serving them.

India's regime turned operational in November 2025, when the Ministry of Electronics and Information Technology notified the DPDP Rules under the Digital Personal Data Protection Act, 2023. Compliance lands in phases: the consent manager framework becomes operational on 13 November 2026, and substantive obligations covering notice, security safeguards, breach reporting, and data principal rights follow on 13 May 2027.

Penalties give that timeline weight, reaching ₹250 crore per violation. For organizations processing the data of people in India, 2026 functions as a build year rather than a grace period.

How to Protect PII

Protection runs as a sequence, and skipping the first step quietly undermines every step after it.

1. Inventory what exists. No organization secures data it has not located, and PII drifts far from its home database into backups, analytics exports, support tickets, and spreadsheets on individual laptops.
2. Collect and keep less. Every field an organization declines to gather, and every record it deletes on schedule, is one that no future breach exposes.
3. Encrypt and restrict access. Encryption at rest and in transit, role-based permissions limited to what each job needs, and retention rules that actually trigger deletion form the working baseline.
4. De-identify with precision. De-identified records keep a separately stored key that restores identity, while anonymized records have no key and no route back, which suits analytics permanently.
5. Monitor beyond the perimeter. Once records leave, internal controls no longer reach them, and where they resurface becomes the only signal left.

Finding Exposed PII Outside the Perimeter

Most organizations learn about a PII leak long after it happens, often from a customer, a regulator, or a journalist. By then the records sit on a forum or a leak site, well beyond the reach of firewalls and access policies.

CloudSEK's XVigil monitors dark web marketplaces, breach forums, paste sites, and messaging channels for an organization's exposed records, credentials, and documents, giving security teams a chance to respond while the leak still has a narrow blast radius. SVigil handles the vendor side of the same problem, scanning third-party infrastructure for the misconfigurations that push customer data onto the public internet.

Frequently Asked Questions

Is an IP address considered PII?

Yes, GDPR treats an IP address as personal data because it singles out a device traceable to a person. US frameworks classify it as PII only once it is linked to other identifying details.

Can an organization collect PII without consent?

Yes, consent is one lawful basis among several. GDPR permits processing under contract, legal obligation, or legitimate interest, while India's DPDP Act relies more narrowly on consent and specified legitimate uses.

Does PII protection apply to deceased individuals?

No, GDPR and India's DPDP Act apply only to living individuals. HIPAA is the notable exception, protecting health records for 50 years after death.

Are cookies and device identifiers PII?

Yes, cookies and device identifiers count as personal data under GDPR when they single out a user, even with no name attached. Treatment across US state laws varies.

What is the first step after a PII breach?

Contain the exposure by revoking access and isolating the affected system. Scoping which records were involved comes next, before regulator and individual notification deadlines start running.

What is the difference between PII and confidential business information?

PII identifies individuals, while confidential business information covers corporate assets such as trade secrets, pricing, and contracts. Leaked PII triggers privacy law; leaked business data triggers commercial consequences.