# What is PII (personally identifiable information)?

> PII (personally identifiable information) is information that can identify a person, alone (like a name or email address) or combined with other linked data. US federal guidance uses "PII"; EU and UK law use "personal data" and California's CCPA uses "personal information," each with its own legal definition.

Source: https://sellmydata.com/glossary/pii/
Published: 2026-11-01

## How the definitions differ

The terms differ by jurisdiction: US federal guidance says PII, EU and UK law say personal data, and California says personal information. All of them cover information that identifies a person directly or by linking it to other data.

A widely used US federal reference is [NIST Special Publication 800-122](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-122.pdf). It covers information that can distinguish or trace a person's identity (name, social security number, date and place of birth, biometric records) plus anything linked or linkable to them, such as medical, financial or employment details. NIST's glossary uses a shorter version from [OMB Circular A-130 (2016)](https://csrc.nist.gov/glossary/term/personally_identifiable_information). The international standard [ISO/IEC 29100](https://www.sis.se/api/document/preview/914169/) takes a similar view and calls the person the data is about the "PII principal."

[GDPR Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) defines personal data as any information relating to an identified or identifiable person, who can be identified by reference to identifiers such as a name, location data or an online identifier. California's [CCPA](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) uses "personal information," which covers information that identifies, relates to, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

## Direct and linkable identifiers

Some details identify someone on their own. The [US Department of Commerce](https://www.commerce.gov/opog/it-privacy-policy-office-privacy-and-open-government-us-department-commerce) lists name, address, social security number and email address. Others, like date of birth, religion or weight, become PII [only once tied to a specific person](https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=905656). ISO/IEC 29100 says to judge identifiability by [all the means that could reasonably be used](https://www.sis.se/api/document/preview/914169/) by whoever holds the data or by anyone else. Its [2024 edition](https://standards.iteh.ai/catalog/standards/iso/68c5a927-d825-428e-902d-644b5ddac8fc/iso-iec-29100-2024) adds that PII can be sensitive if it lets someone infer things like health, even when it never states them.

## Pseudonymised is not anonymous

Pseudonymised data is generally still treated as personal data. Pseudonymisation means swapping a person's identity for a code. The UK regulator, the ICO, says this [does not change the data's status as personal data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/), and that datasets labelled "anonymised" [often still contain personal data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/). According to law-firm commentary, the US FTC restated in a July 24, 2024 Technology Blog post that [hashing or pseudonymizing identifiers does not make data anonymous](https://privacymatters.dlapiper.com/2024/07/ftc-reiterates-that-hashed-and-pseudonymized-data-is-still-identifiable-data/). Law-firm commentary on ICO guidance published on 28 March 2025 adds that the same data can be [personal for one organisation and anonymous for another](https://www.taylorwessing.com/en/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---new-ico-guidance-on-anonymisation-and-pseudonymisation) that has no reasonable way to identify people.

## Why it matters when data is used for AI training

Models can memorise what they are trained on. In a paper presented at USENIX Security 2021, researchers [extracted verbatim passages from GPT-2's training data](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting), including publicly available names, phone numbers and email addresses, even from sequences that appeared in only one document. A seminar abstract on the work notes such attacks [become much easier as models grow larger](https://www.its.uni-luebeck.de/forschung/forschungsseminar/2021-09-21-nicholas-carlini-extracting-training-data-from-large-language-models).

For a company considering licensing its messages, tickets or documents, finding and removing PII is a core step, but not the only safeguard. At SellMyData, people's names, contact details and identifiers are [replaced with consistent placeholders](https://sellmydata.com/de-identification/) before anything is listed; that page also explains the limits. Every dataset also goes through a [rights check](https://sellmydata.com/rights/) with the company before listing, buyers see only a redacted sample before purchase, and the licensed lab receives the de-identified dataset, never raw data. It [does not buy consumer personal data](https://sellmydata.com/sell-my-data/). Because definitions vary by law and jurisdiction, treat this entry as general information and check specific datasets with counsel.

## Frequently asked questions

### Is PII the same as personal data?

They are closely related but come from different frameworks, each with its own definition. PII is the term used in US federal guidance such as NIST's. "Personal data" is the GDPR term and covers any information relating to an identified or identifiable person, including identification by location data or an online identifier.

### Is pseudonymized data still PII?

Usually, yes. The UK ICO says replacing a person's identity with a code does not change the data's status as personal data, and, according to law-firm commentary, the US FTC restated in July 2024 that hashing or pseudonymizing identifiers does not make data anonymous. Under ICO guidance published in March 2025, as summarised by law-firm commentary, the same data can be anonymous for an organisation with no reasonable way to identify people. Treat this as general information and check specific cases with counsel.

### Is an email address PII?

Yes. The US Department of Commerce lists email address alongside name, address and social security number as direct examples of PII. How a specific email address is treated can still depend on the law and context, so check particular cases with counsel.

### Does de-identified data count as personal information under the CCPA?

The California Consumer Privacy Act excludes deidentified and aggregate consumer information from its definition of personal information. Whether a specific dataset meets that standard is a legal question to review with counsel.

## Sources

- [NIST SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-122.pdf)
- [Personally Identifiable Information (PII) - Glossary](https://csrc.nist.gov/glossary/term/personally_identifiable_information)
- [NIST publication on PII (linkable information)](https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=905656)
- [IT Privacy Policy, Office of Privacy and Open Government](https://www.commerce.gov/opog/it-privacy-policy-office-privacy-and-open-government-us-department-commerce)
- [ISO/IEC 29100 Privacy framework (preview)](https://www.sis.se/api/document/preview/914169/)
- [ISO/IEC 29100:2024](https://standards.iteh.ai/catalog/standards/iso/68c5a927-d825-428e-902d-644b5ddac8fc/iso-iec-29100-2024)
- [Art. 4 GDPR – Definitions](https://gdpr-info.eu/art-4-gdpr/)
- [California Civil Code § 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.)
- [What is personal data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/)
- [Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/)
- [How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/)
- [New ICO guidance on anonymisation and pseudonymisation](https://www.taylorwessing.com/en/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---new-ico-guidance-on-anonymisation-and-pseudonymisation)
- [FTC reiterates that hashed and pseudonymized data is still identifiable data](https://privacymatters.dlapiper.com/2024/07/ftc-reiterates-that-hashed-and-pseudonymized-data-is-still-identifiable-data/)
- [Extracting Training Data from Large Language Models](https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting)
- [Extracting Training Data from Large Language Models (seminar abstract)](https://www.its.uni-luebeck.de/forschung/forschungsseminar/2021-09-21-nicholas-carlini-extracting-training-data-from-large-language-models)