What is PII? It depends…
PII is personally identifiable information. In a nutshell, it is information that identifies a person. This can be information alone that maps back to you, such as your Social Security Number (SSN). This is called direct PII because only one person can have a specific SSN. To make it more confusing, the privacy community now refers to this data as personal information (PI). NIST and the cybersecurity community still use PII to refer to personal information. You need to work very closely with the Legal and Compliance departments. They should be the ones formally defining PII. Before we go on, I need to add a legal disclaimer that when classifying your data, a consultation with a privacy professional is recommended. Depending on the type of data, the location of a company’s headquarters, and where
the data is stored (that is, in which country), the definition of PII may change. For example, if the data is stored in Germany, then the definition...
