Examples of PII (Personally Identifiable Information)
Examples of PII (personally identifiable information) include full names, email addresses, phone numbers, postal addresses, dates of birth, Social Security numbers, passport and driver's license numbers, credit card and bank account numbers, IP addresses, and biometric data. Any data that identifies a specific person, alone or combined, counts as PII.
PII is any data that can identify a specific person. Some PII identifies someone on its own, like a passport number. Other PII only identifies someone when you combine it with more data, like a ZIP code plus a birth date. This page lists concrete examples, splits direct from indirect PII, and shows how PII differs from PHI and PCI.
PII vs PHI vs PCI
| Term | What it covers | Governing rule | Examples |
|---|---|---|---|
| PII | Any data that identifies a person | GDPR, CCPA, NIST | Name, email, phone, address, SSN, IP address |
| PHI | Health data tied to an identifiable person | HIPAA (US) | Diagnosis, treatment, medical record number, insurance ID |
| PCI | Payment card data | PCI DSS | Card number (PAN), expiry date, CVV, cardholder name |
What counts as PII?
PII stands for personally identifiable information. It is any data that can identify a specific living person, either by itself or when combined with other data.
Regulators use slightly different wording. The US NIST definition covers any information that can distinguish or trace an individual's identity. The EU GDPR uses the broader term personal data, which covers any information relating to an identified or identifiable person. Both cover the examples below.
The key test is identifiability. A first name alone usually is not PII because many people share it. A first name plus a home address and a date of birth is PII because together they point to one person.
What are common examples of PII?
Below are the most common examples, grouped by type. Many appear in everyday text like support tickets, chat logs, forms, and documents.
- —Names: full name, first name, last name, maiden name, alias
- —Contact details: email address, phone number, postal or mailing address
- —Government IDs: Social Security number (SSN), passport number, driver's license number, national ID, tax ID
- —Financial data: credit card number, debit card number, bank account number, IBAN
- —Dates: date of birth, and other dates tied to a person
- —Online identifiers: IP address, device ID, cookie ID, account username, URL with a user handle
- —Secrets and credentials: API keys, access tokens, passwords
- —Biometric data: fingerprints, face scans, voiceprints
- —Other: vehicle plate number, geolocation, employee or student ID
What is the difference between direct and indirect PII?
Direct PII identifies a person on its own. Examples are a Social Security number, a passport number, a full name with an address, or an email like jane.doe@company.com.
Indirect PII, also called quasi-identifiers, does not identify a person alone but does when combined with other fields. Classic examples are ZIP code, gender, and date of birth. A well-known study showed that this trio alone can uniquely identify most people in the US.
This matters for redaction. Removing only direct identifiers can still leave enough indirect data to re-identify someone, so treat quasi-identifiers as sensitive too.
How does PII differ from PHI and PCI?
PII is the broad category. PHI and PCI are narrower subsets tied to specific rules. The table below compares them.
What are examples of sensitive PII?
Some PII carries higher risk if exposed. This is often called sensitive PII or, under GDPR, special category data.
Examples include Social Security numbers, financial account and card numbers, health and medical records, biometric data, precise geolocation, and data on race, religion, sexual orientation, or union membership. Exposing this data can lead to identity theft, fraud, or discrimination, so it usually needs stronger controls than a plain email address.
How Sanitext detects and redacts PII in text
Sanitext is an API that finds and masks PII in free text. It is a data-minimization aid, not an anonymization or compliance guarantee, so always pair it with your own review and policies.
POST /v1/detect returns each entity as a span with a label, byte offsets, a confidence score, and the matched text. POST /v1/redact returns the same text with each span masked as a label tag like [EMAIL] or [PHONE].
It detects common PII labels including FIRSTNAME, LASTNAME, EMAIL, PHONE, ADDRESS, DATE, URL, ACCOUNT (card and account numbers), and SECRET (API keys and tokens), across 30+ languages. The model runs on our own infrastructure, so your text never goes to a third-party LLM. You can try it in the playground or wire it up from the docs in about a minute.
FAQ
Is an email address considered PII?+
Yes. An email address is PII because it can identify or contact a specific person, especially when it contains a real name like john.smith@example.com. GDPR and CCPA both treat email addresses as personal data, even role-based ones in many cases.
Is an IP address PII?+
Often yes. An IP address is treated as PII under GDPR because it can help identify a device and, indirectly, a person. US rules are less strict, but many privacy laws and security teams classify IP addresses as personal data or quasi-identifiers.
What is the difference between PII and sensitive PII?+
PII is any data that identifies a person, like a name or email. Sensitive PII is a higher-risk subset whose exposure can cause serious harm, such as Social Security numbers, financial accounts, health data, and biometrics. Sensitive PII usually needs stronger protection.
Does removing names make data anonymous?+
No. Removing names alone is rarely enough. Indirect identifiers like ZIP code, date of birth, and gender can re-identify a person when combined. Redaction reduces risk but is not the same as anonymization, which requires removing or generalizing quasi-identifiers too.
Find PII in your own text
Paste a sample into the Sanitext playground to see detected names, emails, phones, and more, or read the docs to call /v1/detect and /v1/redact in about a minute.
Get your free API key