Glossary
PIIpersonally identifiable information
Personally identifiable information is anything that identifies a particular person, and it is the category most data protection rules are built around.
In plain terms
Anything that points at one particular person rather than at people in general. Obvious examples are a name, an email address or an identity number. Less obvious ones are a job title in a small company, a device identifier, or two harmless-looking details that together leave only one candidate. The test is whether somebody could be picked out, not whether the field was labelled as personal.
Why it matters
Because it is the thing that decides whether a piece of work needs care at all, and because in AI work it arrives through the door nobody is watching. Organisations think carefully about the databases where personal information obviously lives, and then somebody pastes a customer email thread into an assistant to get help drafting a reply. The material is the same material. What changed is that it left through a route that looked like typing rather than like moving data.
How it works
The category is defined by what can be worked out, not by what is written down. A record with the name removed is not automatically outside it, because a postcode, a date of birth and a job title can leave exactly one person, and combinations do a great deal of the work here. That is the single most common misreading, and it is why removing the obvious column is a weaker step than it feels.
Free text is where it actually hides, and free text is most of what AI tools receive. Structured systems have a column called email and somebody has thought about that column. A support ticket, a meeting transcript, a document attached to a question and a conversation history are all unstructured, all routinely full of people's details, and none of them has a field anybody labelled.
Context decides as much as content does. A first name alone identifies nobody in a large organisation and identifies somebody exactly in a team of four. The same string is inside or outside the category depending on what else is available alongside it, which is uncomfortable for anybody hoping to write a rule that can be applied without judgement.
It travels further in AI work than in ordinary systems, and along paths that are harder to picture. Material that goes into a prompt may be retained, may be visible in a conversation history that other people can reach, and may be sent onward to a company you did not choose, because your vendor uses other vendors. None of that is unusual or hidden; it is simply further than most people mentally model when they paste something in.
Removing it before sending is a real technique and it is imperfect. Stripping names and account numbers reduces exposure substantially and does not reduce it to nothing, because the surrounding detail can still be identifying and because automated stripping misses things in unusual formats. Treating it as a reduction rather than as a solution is the honest position.
The practical question is what a piece of material contains rather than which system it came from. A spreadsheet from the customer database is obviously in scope and an internal document about a project is often in scope too, because it names the people on it. Asking the question of the material rather than of its source is what catches the awkward cases.
AI tools can produce it rather than only receive it, which has no equivalent in ordinary systems. A model summarising notes may state something about a person that appeared nowhere in the source, by inferring it from what was there. The output is then material about an identifiable person that your organisation created and holds, which nobody put in. Thinking of personal information as something you collect rather than something you generate is the habit this breaks.
Rules about this vary by place and change, which is genuinely why this page describes the category rather than the requirements. What the category is stays reasonably stable and is useful to understand; what must be done about it depends on where you are, what sort of information it is and what you are doing with it, and that is a question for somebody qualified rather than for a glossary.
Two documents, one obviously in scope
Seen in the wild
Pasting a customer email thread into an assistant to get help drafting a reply, which moves the material without it feeling like moving data.
ChatGPTInternal search reaching across systems, where results can surface documents naming people to whoever asked.
GleanAn automation passing incoming records through a model, where every record carries whatever the sender happened to include.
n8nRunning a model on your own hardware so material identifying people is never sent anywhere at all.
Ollama
Common misconceptions
People assume
We removed the names, so it is anonymous.
In fact
Usually not. What remains frequently identifies somebody through combination: a role, a location, a date and an organisation size can narrow to one person without a name appearing anywhere. Removing the obvious field is a worthwhile reduction and it is weaker than it feels, which is why it is better described as reducing exposure than as removing it.
People assume
It only applies to customer data.
In fact
Staff are people too, and internal material is full of them: performance notes, meeting transcripts, project documents naming who did what. Organisations that have thought hard about customer records have often not thought at all about the internal document somebody is about to attach to a prompt.
People assume
It is fine because we are not storing it.
In fact
Sending is its own event regardless of what you keep. Material may be retained by the vendor, may sit in a conversation history colleagues can reach, and may pass to companies further down the chain. Whether your own systems store a copy is a separate question from what happened when it left.
Telling them apart
PII vs Regulated data
PII
Anything identifying a person. Broad, and mostly a question of judgement.
Categories carrying obligations of their own, such as health or financial records.
Regulated data is usually also personal; personal data is frequently not regulated in that specific sense.
Questions
- How do we tell whether something counts?
- Ask whether somebody could be picked out from it, using anything else reasonably available alongside. That framing catches the combinations a field-by-field check misses, and it is the reason a document with no name in it can still be in scope while a list of names in a huge population may be less identifying than it looks.
- Where does it show up that we would not expect?
- In free text, which is most of what AI tools receive. Transcripts, support tickets, attached documents and conversation histories are full of people's details and have no labelled field anybody reviewed. Structured databases get attention precisely because their columns are named; the unstructured material does not.
- Does stripping details before sending solve it?
- It reduces exposure meaningfully and does not eliminate it. Surrounding context can still identify, and automated stripping misses unusual formats and things it was not built to look for. It is a good control described honestly as a reduction, and a poor one described as making material safe.
- Is it different for AI tools specifically?
- The category is the same; the routes are wider and less visible. Material arrives by being pasted rather than by being transferred, it may persist in a history, and it may pass to further companies your vendor uses. None of that is unusual, and all of it is further than people picture when typing into a box.
- What should we actually do about it?
- Decide what material is permitted in which tools, say so plainly, and use administered accounts where the answers about handling are known. Beyond that the requirements depend on where you are and what sort of information it is, which is a question for somebody qualified rather than for a reference page.
- Why does this page not say what the law requires?
- Because the answer depends on your jurisdiction, the kind of information and what you are doing with it, and a general approximation of it would be confidently wrong for most readers. What the category is stays stable and is worth understanding; what follows from it is advice, and this is a glossary.
Key takeaways
- The test is whether somebody could be picked out; combinations do that, so removing the name is a reduction rather than a solution.
- Free text is where it hides, and free text is most of what AI tools receive.
- AI tools can generate it as well as receive it, which no database does.
- Staff are people too, so internal documents are frequently in scope.
- Sending is its own event, whatever you do or do not store afterwards.
Last checked July 2026