What is personally identifiable information (PII)?
Personally identifiable information (PII) is any data that identifies a specific individual, directly or in combination with other data. Direct identifiers include full name, Social Security number, driver’s license number, email address, phone number, account number, and biometrics. Indirect identifiers such as date of birth, ZIP code, and device identifiers become PII when enough of them are joined. Health information, financial details, and precise location carry extra obligations under laws like the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act, and the General Data Protection Regulation (GDPR).
The format does not matter. A free-text call note that mentions a customer’s daughter and a past-due balance is PII, and so is a scanned driver’s license attached to a ticket.
Why PII matters
PII is the data category most likely to trigger a breach notification, a regulatory fine, or a lawsuit, and it is spread across every system a company runs. Customer records, personnel files, support tickets, call recordings, and email all contain it. AI multiplies the exposure in three ways: documents and transcripts full of PII get indexed for retrieval, prompts carry it to wherever the model runs, and agents with broad data access can surface it to users who should not see it. Data classification, data loss prevention (DLP), and PII redaction address those three paths.
PII in practice
A collections agency wants an assistant that summarizes account history for its collectors. The account data is almost entirely PII, and the agency is bound by the Fair Debt Collection Practices Act and state privacy laws. The team runs the model on its own servers so no account data leaves the building, applies role-based access control so each collector sees only their own queue, and redacts Social Security numbers and bank details from the text the model receives, since the summary does not need them. Every query is logged against the user who made it. Kirk Tech Solutions typically treats these three controls, private hosting, scoped access, and minimizing what the model sees, as the baseline for any deployment that touches PII.
What to watch for
- Inventory where PII lives before connecting any model to company data, since free-text fields and attachments hold more of it than the schema suggests.
- Ask AI vendors whether prompts are retained, used for training, or visible to support staff, and get the answer in the contract.
- Apply least privilege to agents as strictly as to people, because an agent that can read every customer record will eventually be asked to.
- Minimize what reaches the model, since a task that needs a balance and a due date does not need a Social Security number.