Blog
What people mean by PII
A plain explanation. Laws use related words, and they are not identical.
PII is short for personally identifiable information. In everyday use it means details that can pick out a person: a full name, an email address, a phone number, a government ID, sometimes a precise address. One piece might be enough. Sometimes it takes a few pieces together, such as a job title plus a small company plus a city.
The words shift by country
In Europe, privacy law usually says “personal data”: any information relating to an identified or identifiable person. In the United States, people more often say PII, and different rules define it differently. You do not need to settle that argument to decide what to paste. If it points at a real person, treat it as personal.
Examples that help, and ones that confuse
- A name and an email are the usual case.
- A city on its own is weak. A city plus a rare job plus a school can be enough.
- A made-up example labeled as made-up is not someone’s PII. A “fake” that is actually your client is.
- A password is sensitive, and it may not identify a person by itself. It is still a bad thing to paste.
Vipra does not try to implement every legal definition. It looks for a fixed list: names, emails, phones, IBANs, card numbers, a US Social Security number shape, IPv4 addresses, common API key shapes, JSON Web Tokens, and links that carry a secret. That list is smaller than “anything personal”. It is also why a careful read still matters.