Personally identifiable information (PII)
Information that can identify a specific person, alone or combined with other details, such as a Social Security number, a fingerprint, or a name plus a birth date.
Also called: PII, personal information, personally identifying information
Information that can identify a specific person, alone or combined with other details, such as a Social Security number, a fingerprint, or a name plus a birth date.
What it means
Personally identifiable information (PII) is any information that can identify a specific person, either alone or combined with other details. A Social Security number or a fingerprint is PII by itself. A name, birth date, home address or email address may say little alone. Together, they can point to one person.
There is no single legal definition. Federal agencies, health and children's privacy laws, and each state's breach law define it a little differently. Most state breach laws focus on a first name or initial and last name, plus one more item. That item is a Social Security number, a driver's license number, or a financial account number with its access code. Some laws also cover medical data, biometric data, or an email address with a password.
Settlement notices often say "personal information" or "private information" instead. In practice it means the same thing: the data the company says was exposed or shared.
What it means for you
What was exposed decides how much risk you face and what to do next. If a notice says your Social Security number was involved, consider a credit freeze. That number can be used to open new accounts. If only an email address leaked, the main risk is phishing. Keep your notice letter. It names the data involved, which helps when you explain a loss on a claim form. Every state has a breach notification law, so a company that loses your PII generally has to tell you.
Example
Say a hypothetical online pharmacy tells you a database was copied. The notice lists your name, home address, birth date and Social Security number. Together those four items are enough to apply for credit in your name, so the company offers credit monitoring and a class action may follow. A second company's notice lists only your email address and order history. That is still PII, but it carries less risk of identity theft. The steps you take, and the settlement terms, may look quite different.
FAQ
Usually not. Many people share a name. It becomes PII when it is paired with details such as an address, a birth date or a Social Security number that single out one person.
It can be. An email address often points to one person, and some state laws protect an email address together with a password. Whether it counts depends on the law and the situation.
Related terms
- NIST Computer Security Resource Center: definitions of personally identifiable information
- National Association of Attorneys General: state data breach laws
- FTC: Data Breach Response, A Guide for Business
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.