PII vs personal information vs personal data: which definition applies to your records?

Three terms from three traditions#

PII, personal information and personal data overlap heavily, but they come from different traditions and are not interchangeable. PII grew out of US security and federal practice, personal information is the term used in California's CCPA and many US statutes, and personal data is the GDPR's term, which several US state privacy laws also use.

Why a narrow list of identifiers misleads#

A narrow list of identifiers misleads because it suggests that records without names, Social Security numbers or account numbers are safe. Breach notification laws often work from such lists, but broader privacy laws ask whether a person can be identified by any reasonably likely means.

GDPR Recital 26 frames the test this way: account should be taken of all the means reasonably likely to be used, such as singling out, by the controller or by another person, weighing the cost and time of identification against the technology available. Under that test, a support ticket mentioning the only night-shift supervisor at a named plant can identify someone without containing a name.

The same recital says pseudonymized data that could be attributed to a person using additional information should be treated as information on an identifiable person. Replacing a customer email with a token in a CRM export does not, on its own, take the records out of scope.

Which definition applies to your records?#

Which definition applies depends on whose records you hold, where those people live and the context in which the data was collected, and often more than one applies at once. By MultiState's count, which includes Florida's narrower law, 20 states had comprehensive consumer privacy laws in effect after the Indiana, Kentucky and Rhode Island laws took effect on January 1, 2026, so a customer base spread across states usually brings several definitions into play.

Because the broadest applicable definition sets the review standard, most preparation work treats any information that could reasonably identify a person as in scope. Which laws actually apply is assessed deal by deal with counsel.

What usually counts in operational records#

In operational records, personal information shows up well beyond customer name fields. A review that checks only the obvious identifier columns will miss most of it.

• 1Names, work and personal email addresses, and phone numbers in contact fields, signatures and quoted replies.
• 2Home addresses and access notes in job, dispatch and service records.
• 3Employee IDs, usernames and assignee fields in tickets, issues and work orders.
• 4Vehicle IDs, GPS traces and timestamps that can be linked to a driver or technician.
• 5Free-text descriptions of people, such as a customer's health situation or a staff member's performance.
• 6Voice recordings, call transcripts and photos taken on site.
• 7IP addresses, device identifiers and browser details in logs.
• 8Combinations such as a job title plus a small office location that single out one person.

De-identified, pseudonymized and anonymous#

De-identified, pseudonymized and anonymous describe data changed so it no longer identifies people, and each law draws the line differently. Under the GDPR, anonymous information falls outside data protection rules, while pseudonymized data that can be re-attributed with additional information remains personal data; GDPR Article 4(5) expects that additional information to be kept separately and protected.

California's definition of deidentified information in Civil Code 1798.140(m) adds conditions beyond technical changes. The business must take reasonable measures against re-association with a consumer or household, publicly commit to keeping the data deidentified and not attempting re-identification, and contractually bind recipients to the same terms. Removing names is necessary, but it is not sufficient on its own.

Illustrative: a staffing firm sorts its ATS records#

Illustrative: a fictional staffing firm runs Bullhorn as its applicant tracking system and wants to know which of its records could ever be part of a data license. Its records include candidate profiles and resumes, client contact records, job orders and recruiter notes on placements.

Counsel's working map treats candidate profiles as personal information under every definition that may apply, including the CCPA for California applicants, and excludes them from scope. Client contact records are B2B data, which California covers and some other states do not, so they are excluded as well. Job orders and the placement workflow are considered only after names, employers and identifying combinations are removed.

The result is a far narrower scope than the firm first imagined, but one that holds up under every definition that may apply rather than only the narrowest.

How SourceX applies these definitions#

SourceX prepares records against the broadest definition that may apply to them, because a dataset can be reviewed under several laws at once. During the Rights and Preparation steps of the SourceX five-step transaction, the people and jurisdictions represented in the records are mapped, and personal and confidential details are removed before anything is released.

The privacy record in the SourceX Evidence Packet notes which definitions and laws were considered and which methods were used. The supplier's counsel assesses which laws apply, and the supplier approves the prepared dataset.