What Is PII (Personally Identifiable Information)?

What does PII mean?

PII is any information that can identify a specific person, on its own or when joined with other data. A full name on its own is PII. A ZIP code on its own usually is not, but a ZIP code plus a birth date plus a gender can pinpoint one person, so together they count as PII.

Privacy laws use slightly different words. US guidance (NIST SP 800-122) talks about PII. The EU GDPR uses the broader term personal data, which covers anything relating to an identified or identifiable person. The practical idea is the same: if data points back to a human, treat it as sensitive.

What are direct and indirect identifiers?

PII splits into two groups. Direct identifiers name a person by themselves. Indirect (or quasi) identifiers do not name anyone alone, but they narrow the field until one person is left when you combine enough of them.

• —Direct identifiers: full name, email address, phone number, postal address, passport or national ID number, bank account number, credit card number, API keys or secrets tied to an account.
• —Indirect identifiers: date of birth, ZIP or postal code, job title, IP address, device ID, gender, employer.
• —Combination risk: studies show roughly 87% of the US population can be uniquely identified by just ZIP code, birth date, and gender combined.

What are common examples of PII?

Most teams hold more PII than they realize. It hides in support tickets, chat logs, CRM notes, application logs, and prompts sent to AI models.

• —Names and titles: "Dr. Maria Schneider", "Raul Lopez"
• —Contact data: jane@example.com, +1 415 555 0142
• —Locations: "221B Baker Street, London"
• —Financial data: card number 4111 1111 1111 1111, IBAN, account numbers
• —Dates: a date of birth like 1989-04-12
• —Online identifiers: URLs with user tokens, IP addresses, session IDs
• —Secrets: API keys and access tokens, which leak the person or account behind them

How is PII different from PHI and PCI?

PII is the umbrella term. PHI and PCI are narrower categories defined by specific rules. PHI is health information protected under US HIPAA. PCI is cardholder data governed by the PCI DSS standard. Some data is PII and PHI and PCI at once, such as a patient name printed next to a card number on a medical invoice.

How does Sanitext relate to PII?

Sanitext is an API that detects and redacts PII in text. Send text to POST /v1/detect and you get back the spans it found: a label, the byte offsets, a confidence score, and the matched text. Send text to POST /v1/redact and you get the same text with each span masked as a tag like [EMAIL] or [PHONE].

It labels FIRSTNAME, LASTNAME, EMAIL, PHONE, ADDRESS, DATE, URL, ACCOUNT, and SECRET across 30+ languages. Common uses are cleaning prompts before they reach an LLM, scrubbing logs, and masking support tickets.

One honest note: Sanitext is a redaction and data-minimization aid, not an anonymization or compliance guarantee. It reduces exposure, but you still own your legal obligations under GDPR, HIPAA, or other rules. You can try detection live in the playground before writing any code.

FAQ