What is PII (personally identifiable information)?
A support ticket pasted into a chatbot prompt leaves your infrastructure the instant the request sends. No firewall catches that, because nothing was breached. The data just left through the front door.
PII (personally identifiable information)
personal data
PII, personally identifiable information, is any data that identifies a specific person, either directly or by combination with other data you hold. A name and a street address both qualify alone. A birth date and a ZIP code qualify together.
NIST's working definition, from SP 800-122, covers two kinds of field. Direct identifiers trace a person on their own: name, social security number, biometric record. Linkable information does the same job in combination, such as a job title crossed with an employer and a city.
GDPR calls the same idea personal data and draws the boundary wider still. Article 4 defines it as any information relating to an identified or identifiable natural person. There is no requirement that it distinguish one person from another, the way PII traditionally does. An opinion about a product, tied to the person who wrote it, counts under GDPR. It often would not under a narrower PII reading.
That gap matters for anyone building on US and EU users at once. A field a US team waves through as non-identifying can still count as personal data under GDPR. Build to the stricter definition.
The LLM turned every field into an export
Before an LLM sat in the stack, PII mostly stayed inside a system you controlled. A database had access rules. A CSV export needed someone to click a button. An API call to a model provider needs neither. The prompt is the export, and it fires on every request a feature makes.
This is why a privacy policy is not a control. A policy says what a vendor will do with data once it arrives. It does not stop your own code from sending a customer's full record when the ticket summary only needed the complaint. Classification has to run before the request leaves, in the code path, not in a document someone signed once.
The fix is not banning PII from prompts. Most useful features need some of it. Decide, field by field, what the model actually needs. Strip the rest before the call, not after a review notices.
- 01Direct identifiers: name, email, phone number, government ID, biometric data.
- 02Linkable combinations: birth date plus ZIP code, job title plus employer plus city.
- 03Online identifiers: IP address, device ID, account handle tied to a real person.
- 04Free text: support tickets, call transcripts and notes, where identifiers hide in sentences rather than fields.
- Field or textTicket, form, transcript.
- ClassifyBefore the request builds.
- Strip or maskRemoves what the model does not need.
- API callProvider sees only what remains.
- Log the decisionRecords what was removed, and why.
Move classification after the call and you are auditing a leak, not preventing one. The provider already has the data by the time a review would catch it.
Related questions
01Which fields count as PII?
Name, email address, phone number, physical address, government ID number and biometric data are direct identifiers on their own. Birth date combined with ZIP code, or job title combined with employer and city, identifies someone through combination rather than a single field. Free text like a support ticket or a call transcript often carries PII in sentences, not labeled fields. That is why keyword scanning alone misses it.
02Is an IP address PII?
Yes. NIST's definition covers information linkable to a person, and an IP address routinely links back to an account or a household. GDPR names online identifiers explicitly in Article 4. Treat it as PII by default rather than arguing the exception.
03What is the practical difference between PII and PHI?
PHI is the subset of PII that carries health information and is held by a party HIPAA covers. Two things must be true at once. The data says something about a person's health, care or payment for care, and it can be traced back to them. PII with no health content, like a shipping address on its own, is not PHI and does not trigger HIPAA's rules.
Keep reading
- PHI (protected health information) →The subset of PII that HIPAA governs, and where the 18 identifiers come from.
- How do you build HIPAA-compliant AI? →Where PHI enters an AI pipeline, and what has to be true at each point.
- What to ask an AI vendor →The questions that surface how a vendor actually handles your data.
