What is PII and how does it differ from special categories of data?

PII, personally identifiable information, is any information that, alone or combined with other data, identifies or renders identifiable a natural person. Name, email, IP address and phone number are the most obvious examples, but the category is broader than it looks: even seemingly harmless data becomes identifying once cross-referenced. A postal code combined with date of birth and gender, for instance, can be enough to single out a specific person in a dataset, even without a name ever appearing. That is why classifying personal data cannot stop at spotting fields with an obvious label: it also has to consider combinations that, taken together, recreate an identity. For a company handling employee, customer or user data, understanding what genuinely counts as PII is the first step before any conversation about security or compliance, because every subsequent measure builds on that classification.

The distinction from special categories

The GDPR distinguishes "ordinary" personal data from the special categories defined in Article 9: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, plus data concerning health, sex life or sexual orientation, and biometric or genetic data processed to uniquely identify a person. It is not a formal distinction: processing these categories requires stricter legal bases and additional safeguards compared to ordinary personal data, and in many cases processing is prohibited except for specific exceptions the rule itself provides. A company collecting health data from employees for insurance purposes, or biometric data for access control, sits on a different level of accountability than one handling only names and emails.

The common mistake: underestimating indirect identifiability

Companies tend to protect the "obvious" fields well, name and email first, but overlook that seemingly anonymous data, an IP address, a device identifier, a browsing behavior pattern, remains PII if it allows tracing back to a person, alone or combined with other datasets already available within the company or on the market. An application log recording only device identifiers may look harmless in isolation, but becomes identifying as soon as it is cross-referenced with another system that links that identifier to a customer account.

Why it matters for AI too

Correctly classifying what counts as PII in a company is the prerequisite for applying the right techniques: masking and tokenization in test environments, granular access control, and minimization of collection from the source. Without accurate upstream classification, these techniques get applied in the wrong place or not applied at all. The topic has become more urgent with AI: an LLM that answers by citing personal details present in the documents it was trained on, or that it accesses via RAG, can expose PII in non-obvious ways, without anyone having designed for it intentionally. This makes data classification a prerequisite for a secure AI deployment too, not only for traditional GDPR compliance. Without knowing precisely where PII sits across your systems, every other data security measure starts from an uncertain foundation: see also GDPR and AI for the full regulatory framing.

This entry is informational and does not constitute legal advice: for decisions on regulated data, involve your DPO or legal counsel.