What is PII? Types of personal data under GDPR
8 min read
PII (Personally Identifiable Information) is any information that can identify a specific person — directly, like a name or email, or indirectly, like an IP address combined with a date of birth. Under the GDPR the equivalent legal term is “personal data”: Article 4(1) defines it as any information relating to an identified or identifiable natural person. Getting this definition right is the first step in any anonymization or compliance effort — you cannot mask what you have not learned to recognise.
TL;DR
- PII is the common (mostly US) term; personal data is the GDPR legal term. They overlap heavily, but personal data is broader.
- GDPR Art. 4(1) covers any information about an identified or identifiable person — directly or indirectly.
- Identifiers split into direct (name, email, national ID), indirect / quasi-identifiers (postcode, job title, birth date), and special category data (health, biometrics, beliefs — Art. 9).
- IP addresses, cookies and device IDs are personal data in the EU (confirmed by the CJEU Breyer ruling).
- Truly anonymized data and data about a legal person (a company) are generally not personal data.
What is PII, exactly?
PII stands for Personally Identifiable Information. It is any data that, on its own or combined with other data, points to one specific human being. The term comes from US privacy practice and has no single statutory definition — different US laws and agencies draw the line in different places.
The GDPR does not use the phrase “PII” at all. Its equivalent concept is personal data, defined in Article 4(1):
“‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
Two words in that text do most of the work: “any” (the definition is deliberately broad) and “indirectly” (you do not need a name to identify someone).
Is PII the same as personal data under GDPR?
Not exactly. They describe the same underlying idea — information tied to a person — but they are not interchangeable:
| PII (US usage) | Personal data (GDPR) | |
|---|---|---|
| Legal status | No single legal definition | Defined in Art. 4(1) |
| Scope | Often a fixed list of identifiers | Context-based: anything that can identify someone |
| IP addresses / cookies | Often not treated as PII | Personal data |
| Where used | US frameworks, security teams | EU / UK law |
The practical rule: all PII is personal data, but not all personal data would traditionally be called PII. The GDPR is broader — it captures online identifiers (cookies, device IDs, IP addresses) that older PII checklists ignore.
Types of identifiers: direct, indirect, and special category
Personal data comes in three practical flavours. The distinction matters because indirect identifiers are the ones people most often forget to mask.
| Type | What it is | Examples |
|---|---|---|
| Direct identifiers | Point to a person on their own | Full name, email address, phone number, PESEL, passport number, IBAN, login |
| Indirect identifiers (quasi-identifiers) | Identify a person only in combination | Postcode, date of birth, job title, employer, gender, car registration, IP address |
| Special category data (Art. 9) | Sensitive data with extra protection | Health, genetic and biometric data, racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, sex life or sexual orientation |
The classic re-identification result — that a US population can be largely singled out by the combination of postcode, date of birth and gender alone — is a direct illustration of why quasi-identifiers are dangerous. None of those three fields “looks like” an identifier, yet together they do the job. (More on this in re-identification risk.)
What is special category (sensitive) data?
Article 9 GDPR singles out data that is especially risky if mishandled and, in principle, prohibits processing it unless a specific condition applies. The special categories are:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data used to uniquely identify a person
- data concerning health
- data concerning a person’s sex life or sexual orientation
Processing this data lawfully requires both a legal basis under Art. 6 and a separate condition under Art. 9. Note that national identifiers such as PESEL are not automatically “special category” data, but they are still personal data and carry their own handling rules.
Is an IP address PII?
Yes — in the EU an IP address is personal data. This was settled by the Court of Justice of the European Union in Breyer v Germany (C-582/14, 19 October 2016). The Court held that a dynamic IP address held by a website operator is personal data whenever that operator has legal means to combine it with information held by the user’s internet service provider to identify the person. It does not matter that the operator alone cannot name the user; what matters is whether identification is reasonably possible using additional information.
The same logic extends to cookies, device IDs and other online identifiers — which is why the GDPR explicitly lists “online identifier” in Art. 4(1).
What is NOT personal data?
Two important exclusions:
- Truly anonymized data. Under Recital 26, data protection principles do not apply to anonymous information — information that no longer relates to an identifiable person. The catch is the standard: data is only anonymous if re-identification is not possible by any means reasonably likely to be used. If a key or lookup table exists anywhere, you have pseudonymization, not anonymization — and it is still personal data.
- Data about a legal person. A company’s registration number or a corporate NIP generally is not personal data, because it relates to a legal entity, not a human. But watch the edges: a sole trader’s NIP, or a company name that is a person’s surname, can still identify an individual. (See anonymizing PESEL, NIP, REGON and KRS.)
Why this matters for anonymization
You can only anonymize what you can detect. A redaction tool that recognises names and emails but misses PESEL numbers, IBANs or IP addresses leaves personal data exposed — and a single overlooked quasi-identifier can be enough to re-identify someone.
This is the concrete list of PII categories that Amaze detects on your machine, out of the box — 13 categories tuned for European workflows:
| Category | Type |
|---|---|
| People (names, incl. Polish grammatical cases) | Direct |
| Email, Phone, Login, Password | Direct |
| PESEL, NIP, REGON, KRS, IBAN | Direct (national / financial IDs) |
| Companies, Locations, Dates | Indirect / quasi-identifiers |
Before / after, the way Amaze renders it:
Before: Jan Kowalski, PESEL 85010212345, [email protected],
logged in from 91.198.174.192 on 2026-03-14.
After: [PERSON], PESEL [PESEL], [EMAIL],
logged in from [IP] on [DATE].Every replacement happens locally, before any text reaches an AI model — so you can use ChatGPT, Claude or Gemini without sending client data to the cloud. For the full picture of anonymization strategy, see our complete guide to data anonymization.
FAQ
What is the difference between PII and personal data? “PII” is the common US term with no single legal definition; “personal data” is the GDPR legal term (Art. 4(1)). Personal data is broader — it covers online identifiers like IP addresses and cookies that many PII checklists leave out. In practice, all PII is personal data, but not all personal data was traditionally called PII.
Is a name always PII? A full name is a direct identifier, but a very common name on its own may not single out one person. Combined with any other field (employer, city, date of birth) it almost always does. Treat names as personal data.
Is an email address personal data?
Yes. An address like [email protected] identifies a person directly — it contains a name and a workplace. Even a non-descriptive address is personal data if it can be linked to a person.
Is a company’s data personal data? Data about a legal person (a company) is generally not personal data. But a sole trader’s tax ID, or a business whose name is a person’s surname, can identify an individual — so check the context rather than assuming.
Does anonymized data count as PII? No. Genuinely anonymized data is no longer personal data and falls outside the GDPR (Recital 26). But the bar is high: if the data can be re-identified by any reasonably likely means, it is still personal data.