What is PII? Everything You Need to Know

The GDPR’s definition of “personal data” is broader than the US concept of “PII.” Under GDPR, personal data includes any information relating to an identified or identifiable natural person — including online identifiers like IP addresses and cookie IDs. US “PII” definitions vary by sector and state law, and are generally narrower, often requiring the data to directly identify an individual. In practice, anonymizing to GDPR scope will usually also catch the data types covered by US PII definitions — but it does not by itself meet the separate obligations of HIPAA, CCPA/CPRA, FERPA or state laws, which need their own assessment.

In most cases, yes. An email address that belongs to a person is usually a direct identifier because it can uniquely identify a specific individual without needing additional context. This is true under both GDPR (personal data) and US privacy frameworks (PII). Even a generic work email like info@company.com may qualify if it can be linked to a specific person. A personal email like firstname.lastname@provider.com is treated as personal data or PII under the major privacy regimes, such as GDPR and CCPA/CPRA.

Under the GDPR, yes — IP addresses are explicitly classified as personal data because they can be used to identify an individual, especially when combined with data held by an ISP. The CJEU confirmed this in the Breyer v. Bundesrepublik case (2016). In the US, it depends on context: the CCPA considers IP addresses personal information, while other federal frameworks may not classify them as PII unless they can be directly linked to a specific person. Best practice: treat IP addresses as PII regardless of jurisdiction.

The consequences are severe and multi-layered. Regulatory fines: GDPR allows penalties up to 4% of annual global revenue or €20 million, whichever is higher. Legal liability: class-action lawsuits, individual compensation claims, and breach notifications to the supervisory authority within 72 hours where the breach is likely to put individuals’ rights at risk (GDPR Art. 33) or varying state deadlines (US). Reputational damage: loss of customer trust, negative press coverage, and long-term brand impact. Operational costs: forensic investigation, remediation, credit monitoring for affected individuals, and increased insurance premiums.

The hosted service, anonym.legal, covers 267 entity types across 48 languages. Its hybrid detection engine combines NLP-based named entity recognition (25 spaCy languages + 7 Stanza + 16 XLM-RoBERTa) with pattern recognizers that include checksum validation (Luhn for credit cards, MOD-97 for IBANs, format rules for SSNs). Entity types span identity, contact, financial, health, digital, biometric, employment, and education categories — covering the full spectrum of PII as defined by major regulations including GDPR.

Pre-processing anonymization: detect and remove PII before data reaches the LLM. This eliminates the risk at the source rather than relying on the AI provider’s data handling policies. Use a deterministic detection engine (not another LLM) to avoid circular dependencies where you send sensitive data to one AI to protect it from another. Ensure the anonymization layer supports reversible tokens so authorized users can re-identify data in AI responses when needed. For implementation, use an MCP Server for IDE integration, a Chrome Extension for browser-based AI chats, or a REST API for automated pipelines.

Related: How PII anonymization prevents data breaches →