Personally identifiable information
Personally identifiable information (PII) is information that can identify or trace a person, either by itself or when combined with other information linked to that person.
A Social Security number is an obvious example. Information can also become identifying through its connection to other records. Removing a name from a document does not, by itself, establish that nobody can identify the person it concerns.
NIST’s definitions include information that is linked or linkable to someone, including employment, financial, or medical information in the relevant context. “PII” is a useful security term, but its scope should not be assumed identical to every jurisdiction’s legal definition of personal data.
Review the fields and the recipient
A request for an employee spreadsheet may expose much more than a list of names. Determine which fields are present, why the recipient needs them, and whether the whole file is necessary. The FTC recommends knowing what personal information the business holds, limiting it to what is needed, and restricting access.
That review also applies to forms. Before asking someone to upload an identity document, establish who will receive it and why the document is needed. The recruiting article covers that decision from the applicant’s side; the hosted-form article follows the data collected by a familiar service.