Compliance
Personally Identifiable Information (PII)
Personally identifiable information, or PII, is information that can distinguish or trace an individual’s identity alone or when combined with linked data.
Personally identifiable information, or PII, is information that can distinguish or trace an individual’s identity alone or when combined with linked data.
What Personally Identifiable Information (PII) means
Personally identifiable information, or PII, is information that can distinguish or trace an individual’s identity alone or when combined with linked data.
NIST examples include direct identifiers such as names and Social Security numbers, as well as information that becomes identifying when combined. Sensitivity depends on context, aggregation, population size, and potential harm. A common field can become high risk when linked to financial, medical, or authentication data.
How it works
Organizations inventory where PII is collected, transmitted, stored, displayed, and exported. They minimize collection, restrict access, protect the data according to impact, and define retention and incident response. Voice workflows should also consider recordings and transcripts, not only structured CRMCRMA CRM is the system used to manage leads, contacts, accounts, opportunities, activity, ownership, and follow-up. fields.
Practical use cases
Protecting contact and account details in transcripts
Redacting sensitive identifiers from quality reviews
Limiting CRM fields exposed during a transfer
Classify combinations, not just individual fields. A harmless-looking record can identify someone once location, date, account, and conversation context are joined.
Frequently asked questions
Why does Personally Identifiable Information (PII) matter?
Classify combinations, not just individual fields. A harmless-looking record can identify someone once location, date, account, and conversation context are joined.
Is all PII equally sensitive?
No. The impact depends on the information, context, identifiability, use, and harm from unauthorized access or disclosure. Controls should reflect that risk.
Primary source: NIST’s PII glossary.
Related concepts: data retentionData retentionData retention defines how long recordings, transcripts, messages, personal data, and conversation metadata are kept before deletion or archival., phiPHIPHI, or protected health information, is individually identifiable health information held or transmitted by a HIPAA covered entity or business associate., screen popScreen popA screen pop automatically displays relevant caller or account information when a call connects or transfers to a human., transcriptTranscriptA transcript is the written record generated from a spoken conversation, typically showing what the caller and agent said during a call..