Types of PII Data — Complete Guide to Personal Information
Every type of Personally Identifiable Information (PII) — from names and emails to GDPR special categories
Remove PII from your documents now → Try our free redaction tool
PII (Personally Identifiable Information) includes 10+ standard types — names, emails, phone numbers, SSN, credit cards, IBANs, addresses, national IDs, passports, and IP addresses — plus 7 GDPR special categories (health data, biometric data, genetic data, racial/ethnic origin, religious beliefs, political opinions, and sexual orientation). Always remove all PII before using ChatGPT, Claude, or any AI tool to stay GDPR-compliant. Use our free redaction tool →
What Is PII?
The foundational definition — and why it matters more than ever in the age of AI.
PII stands for Personally Identifiable Information. It is any piece of data — or combination of data — that can be used to identify a specific living individual, either directly or indirectly.
Under the EU's General Data Protection Regulation (GDPR), this is called "personal data" and is defined in Article 4(1) as: "any information relating to an identified or identifiable natural person." The US equivalent — used in CCPA, HIPAA and other laws — uses the term PII.
The key word is "identifiable". A name alone may not identify someone. But a name combined with a date of birth, postcode, or employer almost certainly will. This is why organisations must treat combinations of data with the same care as obviously sensitive identifiers.
If you collect or process PII
Collecting PII means you need a GDPR-compliant privacy policy and a cookie consent banner on your website — or you risk those fines. These tools make that straightforward:
PII vs Non-PII — Real Examples
Not all data about a person is PII. The key test is whether the information can identify a specific individual — directly, or in combination with other data.
| Data Item | PII? | Why / Why Not |
|---|---|---|
| john.smith@email.com | ✓ PII | Directly identifies an individual — unique to a person or household |
| support@company.com | ✗ Not PII | Generic business address — does not identify a specific individual |
| Date of birth: 15/04/1985 | ~ Context | Alone: weak identifier. Combined with a name or postcode: strong PII |
| Revenue: £4.2 million | ✗ Not PII | Business figure — does not identify an individual (unless the business is a sole trader) |
| SSN: 123-45-6789 | ✓ PII | Government-issued direct identifier — uniquely identifies one individual |
| Country: Germany | ✗ Not PII | Too broad to identify anyone — applies to 84+ million people |
| 12 Baker Street, London, W1U 3BL | ✓ PII | Full postal address with postcode — narrows to a specific property and resident |
| User satisfaction: 87% | ✗ Not PII | Aggregate statistic — no individual is identifiable from this figure |
| IP: 203.0.113.42 | ✓ PII | Personal data under GDPR (Breyer v Germany, 2016) — can identify a household via ISP |
| Age range: 35–44 | ✗ Not PII | Demographic bucket — covers millions of people, not an individual |
| Diagnosis: Type 2 Diabetes | 🔴 Special PII | GDPR Article 9 special category health data — highest protection level |
| Product category: electronics | ✗ Not PII | Category label — describes a product, not a person |
| IBAN: GB29 NWBK 6016 1331 9268 19 | ✓ PII | Financial identifier directly linked to an individual's bank account |
Legend: ✓ PII = always personal data | ✗ Not PII = not identifiable on its own | ~ Context = depends on combination with other data
Standard PII Types
These are the most common categories of personally identifiable information found in everyday documents, emails, and records. Click any card to expand the detail.
Full Name
A person's first name, last name, or full name. Names are the most common form of PII and appear in virtually every document. Even partial names (e.g. "John S.") can identify someone in context.
John Smith · María García · 张伟Email Address
Email addresses are direct identifiers — unique to an individual or household, used to contact, track, and authenticate users across virtually every online service.
john.smith@email.comPhone Number
Mobile and landline numbers — including international formats — are direct identifiers. Used for two-factor authentication, marketing, and contact tracking across borders.
+44 7700 900123 · +1 (555) 000-1234Postal Address
Home and work addresses — including street, city, postcode and country — can pinpoint someone's physical location. Combined with a name, they represent a powerful and dangerous combination of PII.
12 Baker Street, London, W1U 3BLNational ID Number
Government-issued identity numbers — such as the UK National Insurance Number, US Social Security Number, Romanian CNP, or German Personalausweis number — are among the most sensitive standard PII identifiers.
SSN: 123-45-6789 · NIN: AB 12 34 56 CPassport & Licence Numbers
Passport numbers, driver's licence numbers, and other travel document identifiers. Commonly found in HR records, onboarding documents, and legal contracts.
Passport: GBR 123456789IBAN & Bank Account Numbers
International Bank Account Numbers (IBANs) and sort code / account number combinations directly identify a person's financial account. Exposure can enable fraud and unauthorised transactions.
GB29 NWBK 6016 1331 9268 19Credit & Debit Card Numbers
16-digit card numbers — including Visa, Mastercard, and Amex formats — are regulated under PCI DSS as well as GDPR. Exposure can result in immediate financial fraud.
4532 0151 1283 0366IP Address
Under GDPR, IP addresses are considered personal data. They can identify a household's approximate location and internet service provider, and are routinely used to track user behaviour online.
192.168.1.1 · 203.0.113.42Date of Birth
On its own, a date of birth is a weak identifier. Combined with a name or postcode, it becomes a strong one. DOBs appear frequently in HR documents, medical records, and legal forms.
15/04/1985 · April 15, 1985Location Data
GPS coordinates, geolocation data from apps, and precise location histories can identify where a person lives, works, or travels. Increasingly regulated under GDPR and CCPA.
51.5074° N, 0.1278° WOnline Identifiers
Cookie IDs, device identifiers, advertising IDs, and similar tokens can identify users across sessions and platforms. GDPR explicitly names these as personal data in Recital 30.
IDFA: A1B2-C3D4-E5F6-G7H8VAT & Tax ID Numbers
Value Added Tax (VAT) numbers, tax identification numbers (TINs), and national tax reference numbers directly identify businesses and individuals in government systems. Classified as personal data under GDPR when linked to an individual.
GB123456789 · DE987654321 · TIN: 12-3456789Employee ID Numbers
Internal employee reference numbers linking an individual to their employment records, payroll, performance reviews, and HR files. Common in HR documents and payslips — constitute personal data under GDPR.
EMP-00421 · HR/2024/0082Vehicle Registration Numbers
Licence plate numbers and VINs can identify the registered owner, linking to a person's home address and identity via government databases. Relevant in insurance documents, incident reports, and logistics records.
AB12 CDE · VIN: 1HGBH41JXMN109186Digital Signatures
Electronic signatures — typed names, drawn signatures, or cryptographic tokens — uniquely identify a signatory's intent and identity. Found in contracts, NDAs, and legal documents.
DocuSign signature blocks · e-sign tokensSocial Media Handles
Usernames, screen names, and social media handles (e.g. @username on X/Twitter, LinkedIn profile URLs) can directly identify individuals. Under GDPR, they qualify as online identifiers and are considered personal data.
@john_smith · linkedin.com/in/johnsmithGDPR Special Categories (Sensitive PII)
Under GDPR Article 9, these categories require a higher level of protection and cannot be processed without explicit legal justification. Use the filter bar above to show only Special Category cards, or click any card to expand.
⚠ Processing special category data without a valid legal basis under Article 9(2) is prohibited under GDPR and can result in fines of up to €20 million or 4% of global annual turnover — whichever is higher.
Health & Medical Data
Medical diagnoses, prescriptions, treatment records, disability status, and health insurance data. This is the most commonly encountered special category in professional documents.
Diagnoses · Lab results · PrescriptionsBiometric Data
Fingerprints, facial recognition data, iris scans, and voice prints. Biometric data is unique, permanent, and cannot be changed — making its exposure irreversible.
Fingerprint IDs · Facial geometryGenetic Data
DNA profiles, genetic test results, and hereditary medical information. Genetic data can reveal information not just about the individual but about their family members.
DNA profiles · Ancestry dataRacial or Ethnic Origin
Information revealing a person's racial or ethnic background. Protected due to the significant risk of discrimination if disclosed without consent.
Nationality · Ethnicity declarationsReligious Beliefs
Religious or philosophical beliefs, including membership of religious organisations. Protected due to the risk of discrimination, persecution, or social harm.
Church membership · Faith declarationsPolitical Opinions
Political views and party affiliation. Particularly sensitive in jurisdictions where political views could expose individuals to retaliation, discrimination, or safety risks.
Party membership · Voting recordsSexual Orientation
Data revealing a person's sexual orientation or gender identity. Protected due to the significant risk of discrimination, harassment, or harm if disclosed.
Relationship status · Identity declarationsTest your GDPR knowledge with our interactive PII Info Test — standard vs special category, real-world examples, instant feedback.
Why PII Is a Risk When Using AI Tools
Using ChatGPT, Claude, or Gemini with unredacted documents creates serious GDPR and data protection exposure.
When you paste a document into an AI tool, that content is transmitted to and processed on the AI provider's external servers. This means any PII in that document has left your organisation's control. Under GDPR Article 28, this constitutes a transfer to a third-party processor — which requires a Data Processing Agreement (DPA), a lawful basis, and potentially a Transfer Impact Assessment if the servers are outside the EU.
Most organisations using AI tools for drafting emails, summarising reports, or analysing data are unknowingly transferring PII every day. This includes names and contact details in email threads, patient information in medical notes, financial identifiers in spreadsheets, and employee data in HR documents.
The solution is simple: redact PII before it reaches the AI tool. By replacing names, emails, IDs, and financial data with neutral tokens (like [NAME_1] or [EMAIL_1]), you can use AI tools freely without transmitting personal data.
AI providers are third-party processors. Sending PII to them without a DPA may violate GDPR.
US-based AI servers mean cross-border data transfers — potentially requiring SCCs or a TIA under GDPR Chapter V.
GDPR fines for unlawful processing can reach €20M or 4% of global turnover — whichever is greater.
Removing PII before pasting into any AI tool eliminates the data protection risk entirely.
Document privacy is one layer. Network privacy is another.
PrivacyPromptAI protects the content of your documents. A VPN encrypts your internet connection so your ISP and network operators can't see which AI services you're accessing — especially important on public or shared Wi-Fi.
PII in Specific Document Types
Every document type carries a different profile of personal data. Select a document type to see what PII it typically contains.
📄 CVs & Resumes
Among the most PII-dense documents in everyday use. Typically contain: full name, home address, phone number, personal email, date of birth, nationality, photo, LinkedIn URL, employment history with employer names and dates, and educational institution names. Some CVs also include national ID numbers, driving licence details, and references with third-party personal data.
🏥 Medical Records
Contain GDPR special category data and all 18 HIPAA Safe Harbor identifiers: patient name, date of birth, address, phone, email, NHS/insurance number, dates of admission and discharge, diagnoses, prescriptions, test results, and treating clinician names. The combination of health status and identity makes these the highest-risk documents for PII exposure.
🧾 Invoices & Purchase Orders
Contain: full name or company name, billing address, email, phone number, VAT/tax ID, IBAN or bank account number, and transaction amounts. When issued to sole traders or individuals, every field is personal data under GDPR. Even business invoices can contain personal data if the named contact is identifiable as an individual.
📋 Contracts & NDAs
Legal agreements typically include: full legal names, home or business addresses, national ID or passport numbers, dates of birth, signatures, and sometimes financial terms tied to individuals. Employment contracts additionally include salary figures, bank details, and personal references. All of this is personal data requiring protection before sharing with AI tools or third parties.
Once you've redacted the PII, you still need to sign it securely. These GDPR-compliant e-signature tools handle the rest:
✉️ Email Threads
Often overlooked as a source of PII. An email thread accumulates: sender and recipient names and email addresses, phone numbers and job titles in signatures, and personal details mentioned in the body — including third-party information about clients, colleagues, or customers who never consented to their data being shared. Always redact the full thread before analysing with AI tools.
📊 Spreadsheets & Databases
The highest-volume PII risk — a single spreadsheet can contain thousands of records each with multiple PII fields: names, emails, phone numbers, addresses, customer IDs, purchase history, and financial data. Hidden rows, filtered views, and metadata can contain additional PII not visible on screen. Pro plan supports XLSX and CSV redaction for bulk data files.
How PrivacyPromptAI Detects PII
Our detection engine identifies all standard PII types automatically — locally in your browser, with nothing uploaded anywhere.
Pattern Matching
Advanced regular expressions detect emails, phone numbers, IBANs, credit card numbers, IP addresses, postcodes and dates — adapting to country-specific formats across 23 languages.
Named Entity Recognition
Our NER engine identifies personal names and organisation names even without a fixed format — handling language-specific name structures across European languages.
Custom Keywords
Add your own terms to the detection list — project codenames, internal identifiers, or any custom phrase you want redacted every time. Available on the Pro plan.
100% Local
Every detection and redaction runs entirely inside your browser. No document content is ever sent to our servers. You can even use it offline.
Still have questions?
Browse the FAQ
Plain-language answers to the most common questions about PII, GDPR, AI privacy risks, and how PrivacyPromptAI works.
Frequently Asked Questions — What Is PII?
Ready to Remove PII from Your Documents?
Our free tool removes all PII types automatically — names, emails, phone numbers, SSNs, credit cards, IBANs and more. 100% local processing. GDPR-compliant.
Try Free Redaction ToolOnce your document is clean
Removing PII is the first step. Here's what privacy-conscious users typically do next: