What counts as PII in company data?
The short answer
What counts as PII in company data depends on which law applies. NIST covers information linked to a person, GDPR covers identifiable persons, and CCPA covers information tied to a consumer or household. Emails, user IDs, voices and inferences count under at least one. Ask a privacy lawyer.
No single list settles the question. Each law words it in its own way. A field can be PII under one law and fall outside another.
What does NIST list as PII?
NIST SP 800-122 says PII is information that can tell who a person is or trace their identity. Examples are a name, Social Security number, date and place of birth, mother's maiden name or biometric records. It adds any other information linked or linkable to a person, such as medical, school, money and job details.
Its example list includes:
- names and ID numbers
- street and email addresses
- phone numbers
- IP or MAC addresses that link to one person
- voice signatures, listed among personal traits
NIST adds that laws define personal information in different ways. The definitions are not interchangeable.
What does the GDPR count as personal data, its term for PII?
Article 4(1) defines personal data as any information about an identified or identifiable natural person. Its examples are a name, an ID number, location data and an online identifier.
Article 4(5) covers pseudonymisation. That means data cannot be tied to a person without extra information. The UK's ICO says pseudonymised data is personal data in the hands of anyone who holds that extra information. Article 9 adds special categories, such as health data and trade union membership.
What does the CCPA add?
California Civil Code 1798.140(v) covers information that could reasonably be tied to a consumer or household. Its list includes:
- real names and aliases
- postal and email addresses
- IP addresses and account names
- audio information
- professional or job-related information
- inferences drawn into a profile
The California Attorney General says the employee and business-to-business exemptions expired on 31 Dec 2022. Staff and business-contact data now fall inside the law.
Where do those definitions land in company tools?
This part is my reading, not a cited list. Email carries sender and recipient addresses, display names and signature blocks. Slack's export ships with a users.json reference file of user IDs, so authors stay identifiable. Tickets carry requester names and phone numbers. CRM records hold contact details and notes. Call recordings hold voices.
Message text can also hold health or family detail. See are Slack messages personal data, pseudonymization vs anonymization and whether AI can re-identify scrubbed messages.
The rights check asks whose records these are and what personal data they hold. Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
