# What counts as PII in company data?

> What counts as PII in company data? NIST, GDPR and the CCPA define it three ways, and email addresses, user IDs, voices and inferences all fall inside.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-counts-as-pii-in-company-data  
Published: 2026-07-07  
Updated: 2026-10-13

## The short answer

What counts as PII in company data depends on which law applies. NIST covers information linked to a person, GDPR covers identifiable persons, and CCPA covers information tied to a consumer or household. Emails, user IDs, voices and inferences count under at least one. Ask a privacy lawyer.

No single list settles the question. Each law words it in its own way. A field can be PII under one law and fall outside another.

## What does NIST list as PII?

[NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final) says PII is information that can tell who a person is or trace their identity. Examples are a name, Social Security number, date and place of birth, mother's maiden name or biometric records. It adds any other information linked or linkable to a person, such as medical, school, money and job details.

Its example list includes:

- names and ID numbers
- street and email addresses
- phone numbers
- IP or MAC addresses that link to one person
- voice signatures, listed among personal traits

NIST adds that laws define personal information in different ways. The definitions are not interchangeable.

## What does the GDPR count as personal data, its term for PII?

[Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) defines personal data as any information about an identified or identifiable natural person. Its examples are a name, an ID number, location data and an online identifier.

Article 4(5) covers pseudonymisation. That means data cannot be tied to a person without extra information. The UK's [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data is personal data in the hands of anyone who holds that extra information. Article 9 adds special categories, such as health data and trade union membership.

## What does the CCPA add?

[California Civil Code 1798.140(v)](https://california.public.law/codes/civil_code_section_1798.140) covers information that could reasonably be tied to a consumer or household. Its list includes:

- real names and aliases
- postal and email addresses
- IP addresses and account names
- audio information
- professional or job-related information
- inferences drawn into a profile

The [California Attorney General](https://oag.ca.gov/privacy/ccpa) says the employee and business-to-business exemptions expired on 31 Dec 2022. Staff and business-contact data now fall inside the law.

## Where do those definitions land in company tools?

This part is my reading, not a cited list. Email carries sender and recipient addresses, display names and signature blocks. [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) ships with a users.json reference file of user IDs, so authors stay identifiable. Tickets carry requester names and phone numbers. CRM records hold contact details and notes. Call recordings hold voices.

Message text can also hold health or family detail. See [are Slack messages personal data](/answers/are-slack-messages-personal-data), [pseudonymization vs anonymization](/answers/pseudonymization-vs-anonymization) and [whether AI can re-identify scrubbed messages](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages).

The [rights check](/rights-check) asks whose records these are and what personal data they hold. Talk to a privacy or commercial lawyer in your state before you sign.

Figure: comparison of Three tests for personal information: NIST SP 800-122 (Linked or linkable), GDPR Article 4(1) (Identifiable person), California CCPA (emphasized: Reaches a household too, Consumer or household). The CCPA is emphasized because its test reaches a household, where NIST and GDPR name an individual.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final)
- [Article 4(1)](https://gdpr-info.eu/art-4-gdpr/)
- [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)
- [California Civil Code 1798.140(v)](https://california.public.law/codes/civil_code_section_1798.140)
- [California Attorney General](https://oag.ca.gov/privacy/ccpa)
- [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports)