What is a PII (Personally Identifiable Information)?

PII spans a spectrum from directly identifying data — full name, Social Security number, email address, government ID number — to indirectly identifying data that only becomes risky when combined with other fields, sometimes called quasi-identifiers. Regulations differ in exactly what they cover: GDPR's "personal data" is broader than the traditional US notion of PII, extending to anything relating to an identified or identifiable person, including IP addresses and device identifiers in many contexts. Handling PII correctly means classifying it at the point of collection, minimizing what's collected to only what's needed, encrypting it at rest and in transit, restricting access to those with a legitimate need, and honoring data-subject rights like access, correction, and deletion requests. Logging and telemetry are common leak points — a stack trace or debug log that captures a full request body can accidentally persist PII in a system never designed to protect it, which is why redaction-by-default and "no PII in logs" are standard engineering rules, not just legal boilerplate. PII handling failures are also often the trigger for breach-notification obligations, so how PII flows through a system (and where it's copied, cached, or exported) needs to be traceable end to end.