Glossary
PII
Personally identifiable information — data that identifies a specific person. The category is narrower than most regulation, which is why "we removed the PII" is rarely the whole answer.
Also called: personally identifiable information
PII is the obvious set: name, email address, phone number, home address, government identifiers, payment details. Anything that points at one person on its own.
Where teams get caught out is treating PII as the whole of privacy law. It is not. The major privacy regimes regulate personal data, which is a wider category — it covers information that identifies someone in combination with other data you hold. A device identifier is not PII in the narrow sense and is squarely personal data in the regulatory sense. So is an IP address, in most readings. So is a browsing history tied to a persistent ID, even with no name attached anywhere.
This is why “we do not collect PII” is a weaker statement than it sounds, and why it is worth asking what someone means by it.
The re-identification problem. Stripping direct identifiers does not necessarily make data anonymous. A small number of ordinary attributes — a postcode, a birth date, a purchase time — can narrow a population to one person. Data that can be re-identified is not anonymous, whatever the field names say, and hashing a value does not change what it points at.
The practical rule is one of purpose, not category. Collect what you need for a stated reason, keep it only while that reason holds, and be able to say which of those things a customer agreed to. That answers the question the label never quite does.
Do not confuse with
Close enough to get mixed up, different enough that the mix-up costs something.
- First-party data Information you collected directly from your own customers through your own properties. Distinct from data bought or obtained through an intermediary.
- Hashing Converting a value into a fixed-length string that cannot be reversed, so two systems can check whether they hold the same value without either sending the value itself.
- Zero-party data Information a customer deliberately gave you about themselves — preferences, intent, stated needs — rather than something you observed. A marketing coinage, not a legal category.