Personally identifiable information (PII): Personally identifiable information (PII) is any data that can identify a specific person on its own or in combination with other data, such as a name, address, Social Security number, email, phone number, photo, or account ID.
Some PII is direct: a full name, a government ID number, a face. Some is indirect: a birth date, a ZIP code, and a job title may each be harmless alone but pinpoint one person together. Regulators treat both kinds seriously. NIST defines PII broadly for federal systems, and state privacy laws, GDPR, HIPAA (for health data), and GLBA (for financial data) each set their own rules for handling it.
AI tools raise the stakes because they make it so easy to move PII around. Pasting a customer list into a chat assistant, uploading a spreadsheet of employees, or letting an agent read your inbox all send PII to a third party. Once sent, you are relying on that vendor's storage, retention, and training terms, and on your contract with them.
The practical habit is redaction before input. Replace names with roles ("Customer A," "the applicant"), delete account and ID numbers, and remove any field the task does not need. Most tasks, from drafting a reply to summarizing a complaint, work fine on redacted text. When you truly need identifiers, use a business or enterprise tier your organization has approved for that data class.
Example at work
An HR coordinator wants an assistant to draft a warning letter based on an incident report. Before pasting, she replaces the employee's name with "the employee," removes the badge number and home address, and deletes a witness's name. The draft is just as usable, and no PII left the company.
Why it matters
Mishandling PII can trigger breach notifications, fines, and lost trust, and it is one of the most common ways well-meaning employees get in trouble with AI tools. Learning to spot PII and strip it before you paste is one of the highest-value AI habits you can build.
Related terms
- Data privacyData privacy, in the context of AI, is the set of rules and practices that govern what information you put into an AI system, who can see it, how long the vendor keeps it, and whether it is used to train future models.
- Workplace AI policyA workplace AI policy is a written set of rules that tells employees which AI tools they may use, what data they may put into them, how to verify and disclose AI-assisted work, and who to ask when unsure.
- AI governanceAI governance is the set of policies, roles, controls, and oversight processes an organization uses to decide how AI is adopted, used, monitored, and held accountable across the business.
- GuardrailsGuardrails are the rules, filters, and technical limits placed around an AI system to keep its behavior within acceptable bounds, such as refusing harmful requests, staying on topic, protecting data, or requiring approval before acting.