Personally Identifiable Information (PII) is any data that can identify a specific individual, either on its own or when combined with other information.
Examples range from obvious direct identifiers, such as a full name, Social Security number, or passport number, to quasi-identifiers that pinpoint someone only when linked together, such as a date of birth plus ZIP code plus gender. Because context determines sensitivity, PII protection starts with classifying data correctly and then applying controls such as encryption, access restrictions, masking, and retention limits.
A common mistake is treating only the obvious fields as PII while ignoring combinations. Data that looks anonymized can often be re-identified by joining it with other sets, so true anonymization is harder than it appears. Regulations like GDPR and HIPAA shape how PII must be handled, and mishandling it drives many breach penalties. NIST offers practical guidance in Special Publication 800-122.
How is PII tested on the CISSP?
PII is central to Domain 2, Asset Security, which covers data classification, ownership, handling, and retention across the information lifecycle. Exam questions often ask you to classify data or choose the right protection for a given data type. Review it in Domain 2 Asset Security.