---
title: What is Personally Identifiable Information (PII)?
description: Learn what qualifies as PII, why it matters under privacy law, and how your company can protect sensitive information and reduce risk from data breaches.
image: https://spzlegal.com/hubfs/31-1.png
---

[Skip To Content](https://spzlegal.com/blog/data-privacy/personally-identifiable-information#main-content)

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

- [Clients](https://spzlegal.com/our-clients) 
    - [Featured Clients](https://spzlegal.com/our-clients)
    - [Case Study: Verto Education](https://spzlegal.com/verto-case-study)
    - [Case Study: Kong Studios](https://spzlegal.com/kong-studios-case-study)
    - [Case Study: WindBorne](https://spzlegal.com/windborne-case-study)
    - [Case Study: Tango](https://spzlegal.com/tango-case-study)
    - [Case Study: Sown To Grow](https://spzlegal.com/sown-to-grow-case-study)
    - [Case Study: Capture6](https://spzlegal.com/capture6-case-study)
    - [Case Study: Datava](https://spzlegal.com/datava-case-study)
    - [Case Study: Voxel](https://spzlegal.com/from-scrappy-startup-to-selling-to-fortune-100)
- [Team](https://spzlegal.com/team) 
    - [About Us](https://spzlegal.com/team)
    - [Becky Mancero](https://spzlegal.com/team/becky-mancero)
    - [David De La Flor](https://spzlegal.com/team/david-de-la-flor)
    - [Elizabeth Thorne](https://spzlegal.com/team/elizabeth-thorne)
    - [Gea Kang](https://spzlegal.com/team/gea-kang)
    - [Hannah Porter](https://spzlegal.com/team/hannah-porter)
    - [Hash Zahed](https://spzlegal.com/team/hash-zahed)
    - [Jessica Sulahian](https://spzlegal.com/team/jessica-sulahian)
    - [Morgan Kasenchak](https://spzlegal.com/team/morgan-kasenchak)
    - [Paige Southworth](https://spzlegal.com/paige-southworth)
    - [Ryan Shaening Pokrasso](https://spzlegal.com/team/ryan-shaening-pokrasso)
    - [Sam Taylor](https://spzlegal.com/team/sam-taylor)
    - [Tami Gore](https://spzlegal.com/team/tami-gore)
    - [Specialists](https://spzlegal.com/our-partners)
- [Services](https://spzlegal.com/business-law-services) 
    - [Formation & Corporate](https://spzlegal.com/business-law-services/formation)
    - [Mergers & Acquisitions](https://spzlegal.com/business-law-services/mergers-acquisitions)
    - [Funding](https://spzlegal.com/business-law-services/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/business-law-services/employment)
    - [Data Privacy](https://spzlegal.com/business-law-services/data-privacy)
    - [IP Protection](https://spzlegal.com/business-law-services/ip-protection)
    - [Commercial Agreements](https://spzlegal.com/business-law-services/sales-agreements)
- [Startup Center](https://spzlegal.com/startup-center) 
    - [Formation & Corporate](https://spzlegal.com/startup-center/formation-and-corporate-topics)
    - [Mergers & Acquisitions](https://spzlegal.com/startup-center/mergers-and-acquisitions)
    - [Funding](https://spzlegal.com/startup-center/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/startup-center/hiring)
    - [IP Protection](https://spzlegal.com/startup-center/ip-protection)
    - [Data Privacy](https://spzlegal.com/startup-center/data-privacy)
    - [Commercial Agreements](https://spzlegal.com/startup-center/commercial-agreements)
- [Blog](https://spzlegal.com/blog)
- [Contact](https://spzlegal.com/contact)

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

# A Guide to Personally Identifiable Information (PII)

[Data Privacy](https://spzlegal.com/blog/tag/data-privacy)

![](https://spzlegal.com/hs-fs/hubfs/31-1.png?width=760&height=428&name=31-1.png)

Nearly every organization collects some form of personally identifiable information (PII)—but few fully understand what qualifies as PII or how to protect it. The stakes are high: mishandling sensitive data can lead to identity theft, data breaches, and a permanent loss of trust.

This guide breaks down what PII means under U.S. privacy law, provides examples of linked and linkable information, and outlines practical steps your company can take to improve data security and reduce risk.

## Understanding PII: What Counts as Personally Identifiable Information?

There’s no single definition of PII. Multiple government agencies define it slightly differently, but the core idea is the same: PII is any information that can be used to distinguish, trace, or infer the identity of a specific individual.

### Common Definitions of PII According to U.S. Agencies:

- [U.S. Department of Commerce](https://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf): Information that can distinguish or trace identity (e.g. name, SSN, biometrics) or is linked/linkable to an individual (e.g. employment, medical, or financial data).
- Department of Homeland Security: Data that permits direct or indirect identification of a person.
- Biometrics Identity Management Agency: Any information that identifies, relates to, or describes an individual.
- National Security Telecommunications Advisory Committee: Even non-obvious data may be considered PII if it can identify someone when combined with other information.

### Types of PII (Linked and Linkable):

PII falls into two categories:

- Linked PII: Clearly identifies a person on its own  
  Examples: Full name, SSN, passport number, driver’s license number, date of birth, phone number
- Linkable PII: Can identify someone when combined with other data  
  Examples: Zip code, race, gender, IP address, login credentials, job title, web cookies

Both must be protected under data protection regulations like the GDPR (which generally refers to PII as “Personal Data”) and HIPAA (which generally refers to “Protected Health Information”).

## Examples of PII Commonly Collected by Businesses

Here’s a non-exhaustive list of PII that may exist in your systems:

- Full name
- Social Security Number (SSN)
- Date and place of birth
- Mother’s maiden name
- Passport or driver’s license numbers
- Biometric data (fingerprints, facial scans, handwriting)
- Phone number
- Email address
- Login credentials (usernames, passwords)
- IP address and device identifiers
- Physical location data
- Medical, educational, or employment records
- Financial account information
- School or workplace names
- Web cookies and behavioral tracking data
- Social media profiles and handles

If your company stores any of these—especially in combination—you likely have legal obligations under privacy law.

## How to Handle PII: 7 Privacy Best Practices for Businesses

Once you determine what qualifies as personally identifiable information, it’s essential to take protective steps. Below are seven privacy law-aligned practices based on recommendations from the U.S. Department of Commerce:

### 1. Minimize the Amount of PII You Collect and Store

Only collect the data you truly need. The less PII you handle, the lower your exposure to regulatory risk and data breach liability.

### 2. Don’t Ask for PII Unless It’s Absolutely Necessary

Audit your forms, processes, and customer touchpoints. If something can function without PII—omit it.

### 3. Review Aging Data Regularly

Outdated or unused PII increases risk. Set a recurring schedule to assess stored data for relevance and eliminate anything obsolete.

### 4. Eliminate Unnecessary PII with Clear Policies

Don’t keep data “just in case.” Create internal protocols to securely delete unnecessary PII as part of your regular operations.

### 5. Categorize PII by Confidentiality Impact

Not all PII carries the same risk. Consider:

- How easily a person can be identified
- How many individuals are affected
- The sensitivity of the data fields
- How the data is used and stored
- Your legal or contractual obligations

### 6. Apply Appropriate Safeguards Based on Risk

Use redaction, encryption, access controls, and employee training. Sensitive PII should receive higher levels of protection.

### 7. Prepare an Emergency Response Plan

Have a documented breach response process:

- Customer notification
- Government reporting
- Remediation services like credit monitoring

## Why PII Management Matters for Startups

You may feel stuck between needing customer data to operate and fearing liability from storing it. But privacy compliance doesn’t have to be overwhelming. By following these reasonable, scalable practices, your company can reduce risk, build trust, and stay ahead of evolving data protection regulations.

## Ready to Build a PII Policy That Meets Legal and Customer Expectations?

Protect your organization and your customers by creating or refining your PII management policies.

[![Contact Us for Data Privacy Support](https://no-cache.hubspot.com/cta/default/44461256/f69bd174-df74-498c-b9da-559de7613866.png)](https://cta-redirect.hubspot.com/cta/redirect/44461256/f69bd174-df74-498c-b9da-559de7613866)

---

*DISCLAIMER: The information in this article is provided for informational purposes only and should not be construed or relied upon as legal advice. This article may constitute attorney advertising under applicable state laws.*

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

Categories

- [Funding](https://spzlegal.com/blog/tag/funding)
- [Incorporation](https://spzlegal.com/blog/tag/incorporation)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Contracts](https://spzlegal.com/blog/tag/contracts)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [M&A](https://spzlegal.com/blog/tag/ma)
- [Firm Culture](https://spzlegal.com/blog/tag/firm-culture)
- [News](https://spzlegal.com/blog/tag/news)
- [Social Enterprise](https://spzlegal.com/blog/tag/social-enterprise)
- [Acquired](https://spzlegal.com/blog/tag/acquired)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Client Engagement](https://spzlegal.com/blog/tag/client-engagement)
- [Nonprofit](https://spzlegal.com/blog/tag/nonprofit)
- [AI](https://spzlegal.com/blog/tag/ai)
- [Artificial Intelligence](https://spzlegal.com/blog/tag/artificial-intelligence)

Recent Posts

- [Becky Mancero Recognized by Best Lawyers: Ones to Watch for Second Consecutive Year](https://spzlegal.com/blog/becky-mancero-best-lawyers-ones-to-watch-2026)
- [What We Fix in Diligence Over and Over Again Before a Financing or Exit](https://spzlegal.com/blog/startup-legal-issues-before-financing-exit)
- [Becky Mancero on the Melissa Widner Podcast: Cap Tables, Equity Mistakes, and AI in the Legal World](https://spzlegal.com/blog/becky-mancero-on-the-melissa-widner-podcast-cap-tables-equity-mistakes-ai-in-the-legal-world)
- [Spinning Out a Product Into a New Startup: Legal Issues Founders Need to Solve Early](https://spzlegal.com/blog/spinning-out-product-new-startup-legal-guide)
- [Converting an LLC to a Corporation: When It Makes Sense and How to Do It Without Creating a Mess](https://spzlegal.com/blog/converting-llc-to-corporation-startup-guide)
- [The Role of LOIs in M&As: Structuring Letters of Intent](https://spzlegal.com/blog/the-role-of-lois-in-mas-structuring-letters-of-intent)
- [Exit Structures: Mergers, Acquisitions, & Tax Treatment](https://spzlegal.com/blog/exit-structures-mergers-acquisitions-tax-treatment)
- [Due Diligence Best Practices: Be Prepared for M&A Success](https://spzlegal.com/blog/due-diligence-best-practices-be-prepared-for-ma-success)

Locations

**San Francisco Bay Area, California**

**Milwaukee, Wisconsin**

**Los Angeles, California**

**Denver, Colorado**

**Miami, Florida**

**Austin, Texas**

Contact Us

[Email](https://spzlegal.com/contact)

Follow Us

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

Startup Topics

- [Formation](https://spzlegal.com/blog/tag/incorporation)
- [Funding](https://spzlegal.com/blog/tag/funding)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [Commercial Agreements](https://spzlegal.com/blog/tag/contracts)
- [M&A Law](https://spzlegal.com/blog/tag/ma)

© 2026 [SPZ Legal, P.C. Startup Lawyers](https://spzlegal.com/)

- [Terms of Use](https://spzlegal.com/terms)
- [Privacy Policy](https://spzlegal.com/privacy)

[![California Chambers Spotlight 2025 Award](https://spzlegal.com/hs-fs/hubfs/ca-chamber-spotlight-2025-badge.jpg?width=300&height=300&name=ca-chamber-spotlight-2025-badge.jpg)](https://chambers.com/law-firm/spz-legal-p-c-120:23727975)

 DISCLAIMER: The information on this website is provided for informational purposes only and may not be updated over time. Nothing on this website should be construed as legal advice or relied upon in any way. No attorney-client relationship is intended to be created through this website. This website may be considered attorney advertising in some states. Prior results do not guarantee a similar outcome.

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Aaron Murphy",
    "url" : "https://spzlegal.com/blog/author/aaron"
  },
  "dateModified" : "2026-05-22T00:22:54.098Z",
  "datePublished" : "2019-06-01T20:15:15.000Z",
  "headline" : "What is Personally Identifiable Information (PII)?",
  "image" : [ "https://spzlegal.com/hubfs/31-1.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://spzlegal.com/blog/data-privacy/personally-identifiable-information",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg"
    }
  }
}
```