A spreadsheet of customer ZIP codes looks harmless until someone adds names. PII data protection starts with that test: can the data identify a person alone, or once combined with other data? If yes, protect it.
The legal detail varies by place and sector, so read this alongside our guide to data privacy laws explained. Here the focus is practical: classify what you hold, then match controls to it.
What counts as PII, and what people get wrong
PII is any data that identifies, relates to, or can be combined with other information to identify a specific person, as Hyperproof’s PII guide defines it. The definition turns on identifiability, not on a fixed list of field names. IBM adds that context also determines whether something is considered PII at all, so the same field can be personal in one dataset and harmless in another.
| Data example | How it behaves | Planning use |
|---|---|---|
| Passport number, driver’s license number | Direct identifier: unique to a person and usually identifies someone alone | Treat as top-priority data from the moment it is collected |
| Government ID numbers, fingerprints, retinal scans, bank and card numbers, medical records | Sensitive PII: misuse can do serious harm to the individual | Place in your strictest handling group and keep it out of general-purpose systems |
| ZIP code on its own | Usually not enough to identify someone | Low concern in isolation, but re-check whenever it sits beside other fields |
| ZIP code combined with other data | Becomes personal because the combination can single out a person | Classify the dataset as a whole, not field by field |
Examples and behaviours come from IBM’s PII overview and Hyperproof’s guide.
Misunderstandings that cause gaps
- “PII is only names and ID numbers.” Direct identifiers are the obvious case, but data that identifies a person only when combined with other information also counts under the definition above.
- “A harmless field stays harmless.” A ZIP code usually does not identify anyone alone, yet it becomes personal in combination. Review datasets after joins, exports and new data sources.
- “All PII needs identical protection.” Government ID numbers, biometrics, financial data and medical records are sensitive PII and deserve tighter handling than a low-risk contact detail.
- “Compliance equals protection.” A legal checklist tells you what to document; classification and controls determine whether the data is actually safe.
From classification to controls
Classification is the step that decides every control after it. The practical test is to classify data by whether it can reasonably identify a person on its own or when combined with other data. Use that test rather than field names, because a column called “region” can be riskier than one called “customer ID” depending on what sits next to it.
- Inventory. List every system, export and shared folder that holds personal data, including copies.
- Apply the identifiability test. Mark each dataset as identifying alone, identifying in combination, or neither.
- Separate the sensitive categories. Government IDs, biometrics, financial data and medical records go in the strictest group.
- Attach handling rules. The same guidance says access should be limited to people and systems with a clear business need, retention should be justified and time-bound, and sharing should be reviewed for re-identification risk.
- Review on a schedule. Re-run the exercise whenever data is combined or a new system is added.
This sequence is what makes the legal definition operational: a regulator’s wording becomes a label on a dataset, and the label triggers specific controls. Those controls are next.
Technical controls for PII
Technical controls fall into two groups that matter most for stored personal data: who can reach it, and whether it is readable if someone reaches it anyway. NIST’s SP 800 series focuses on computer and information security, and the SP 800-53 control catalogue includes a PT family covering PII Processing and Transparency. Use it as a vocabulary for mapping your own controls when auditors or customers ask.
Access limits
Once data is classified as PII, restrict it to people and systems with a clear business need, as the classification guidance cited above advises. In practice that means role-based permissions, no shared accounts and a periodic clean-out of access nobody uses. Strong, unique credentials underpin all of it; for teams without a shared vault, see our comparison, Best Password Manager For Small Business In 2026: Secure, Scalable Picks And How To Choose – Technopolicy.
Encryption at rest and in transit
Encryption is the control that protects PII when other defences fail. Proofpoint’s PII guidance states that sensitive data must be encrypted when stored and when transferred across the network. Data stored on a drive or in a database is “data at rest”; data moving between systems is in transit. Treat them as separate jobs, because a database with encrypted storage can still leak through an unprotected connection.
The sensible order is to start with the strictest group from your classification: encrypt those stores and connections first, then extend coverage. Confirm coverage by checking each system on your inventory, not by assuming a default setting is on.
People, policy and review
Controls fail through human error as often as technical gaps, so policy and training belong in the same plan. Employees should be educated on the dangers of phishing and social engineering, according to Proofpoint, because stolen credentials are an easy route to stored PII.
- Minimise what you keep. Time-bound retention means personal data has an end date that is justified, not an open-ended archive.
- Check sharing before it happens. Review exports and third-party transfers for re-identification risk, especially when combining datasets.
- Review the strategy regularly. Cybersecurity strategies should be reviewed at least annually, and some organisations choose to do it more often. Treat that as a minimum cadence, not a target.
Data breach preparation
A data breach is the scenario every control above is designed for, and PII is a prime target. Proofpoint notes that attackers go after it because of its high value when sold on darknet markets. Your classification work pays off here: you can say quickly which systems held sensitive PII and what was readable.
Build a response plan that covers detection, containment, evidence preservation, internal escalation to legal or compliance, and communication with affected people. Have counsel confirm which breach notification law applies to the people affected, then record that law’s deadline and trigger in the plan, since state and sector rules are set in the legal text itself rather than in security guidance.
Individuals whose identifiers are exposed may want monitoring or recovery help. Our review, Best Identity Theft Protection Companies in 2026: 7 Top Services Compared And How To Choose – Technopolicy, compares options for that follow-up.
Frequently asked questions
| Question | Answer |
|---|---|
| What counts as PII? | Any data that identifies, relates to, or can be combined with other information to identify a specific person. Passport and driver’s license numbers are direct identifiers; government IDs, biometrics, financial data and medical records are sensitive examples. |
| How do I protect PII? | Classify data by identifiability, limit access to people with a clear business need, encrypt it in storage and in transit, set time-bound retention, train staff on phishing, and review the strategy at least annually. |
| Is a ZIP code PII? | On its own it usually is not enough to identify someone. Combined with other data it can become personal, so classify the whole dataset. |
| Why is PII targeted in a data breach? | Attackers value it because it sells at a high price on darknet markets. |
| Which NIST material helps with PII controls? | The SP 800-53 control catalogue includes a PT family for PII Processing and Transparency, and the wider SP 800 series focuses on computer and information security. |
