Personally identifiable information, usually shortened to PII, is any information that can be used to identify a specific person. Your name is the obvious example, but the category is much wider. A phone number, an email address, a home address, a passport number, a fingerprint, even the unique ID baked into your phone all count. The defining test is simple: if a piece of data, on its own or combined with other data, can point to one real individual, it is PII.
The reason this matters is that PII is the raw material of identity theft, fraud, and tracking. It is also the thing you copy and paste more often than you realise. Filling in a form, sharing your address, sending someone an account number, pasting a verification code: all of that is PII moving through your device, and a surprising amount of it lingers in places you do not think about.
What actually counts as PII
Privacy laws and security teams tend to split PII into two buckets, and the split is the most useful thing to understand because it tells you how carefully to treat each piece.
Direct identifiers
These point to you by themselves, with no extra context needed. They are the strongest form of PII.
- Full name
- National ID, passport, or driving licence number
- Social security or tax number
- Bank account and card numbers
- Biometric data such as fingerprints or face scans
- Email address and phone number
Indirect identifiers
On their own these rarely single out one person, but stitched together they can. This is the part people underestimate. A date of birth is shared by millions, and so is a postcode, but the pair of them plus your gender is often enough to identify exactly one person. Researchers have shown that a handful of seemingly harmless fields can be uniquely identifying.
- Date of birth
- Postcode or city
- Job title and employer
- IP address and device identifiers
- Browser or cookie IDs used for tracking
Sensitive PII versus non-sensitive PII
The other split is by stakes. Non-sensitive PII is data that is often already public or low harm if exposed, like your name, your employer, or your general location. Sensitive PII is the data that could cause real damage in the wrong hands, and it deserves much stronger protection.
- Financial: card numbers, bank details, anything that opens a path to your money.
- Government: passport, national ID, social security or tax numbers.
- Health: medical records, diagnoses, prescriptions.
- Credentials: passwords, security questions, two-factor codes.
- Biometric: fingerprints, face data, voiceprints, which you cannot change if leaked.
Credentials deserve a closer look, because so many people copy them out of a password manager all day. A password is sensitive PII, and the clipboard is a leaky place to keep it. We pulled that question apart on its own in is it safe to copy and paste passwords?
Where your PII leaks without you noticing
You guard the obvious moments, like entering your card number on a checkout page. The quieter leaks come from the plumbing you stop seeing. The clipboard is the clearest example. Every time you copy an address, an account number, or a code, it sits in shared system memory that other programs can read, and on desktop there is no permission prompt for that. If you want the full picture of how exposed the clipboard is, the overview lives in is your clipboard a security risk?
Other common leak points:
- Clipboard history. Tools that keep a running list of your copies, including Windows Clipboard History (Win+V), store more than the last item, so a trail of identifiers can build up.
- Form autofill and screenshots. Identifiers get saved in browser autofill and captured in screenshots, both of which are easy to forget about.
- Chats and notes apps. Pasting your address or a code into a messaging app or a shared document spreads copies of your PII to servers you do not control.
How to protect your PII day to day
You cannot stop handling PII, and you would not want to. The goal is to reduce how long it sits exposed and how many unguarded places hold a copy. The device-by-device checklist lives in how to keep your clipboard private, and the short version is this:
- Clear sensitive copies after you paste. Copy a throwaway word over a card number or code so it does not linger on the clipboard for hours.
- Be careful where you paste identifiers. Untrusted sites and random chats are the easiest way for PII to spread further than you meant.
- Share less than you are asked for. Many forms request more PII than they need. Give the minimum.
- Keep your devices patched. Most clipboard and data attacks need malware on your machine first, so the usual hygiene closes the door.
- Encrypt anything you keep. If you store a history of what you copy, make sure it is encrypted so saved PII is unreadable to anyone but you.
Why encryption is the real safeguard
Most PII leaks come down to one thing: the data is sitting somewhere in plain text, waiting for something else to read it. A lingering clipboard item, a history trail, a copy parked on a server. Encryption changes the calculation. If your data is encrypted with a key only you hold, then a snooping app, a breached database, or a stolen backup all come up with noise instead of your name and numbers. That is the idea behind end-to-end encryption, and it is the most reliable way to keep PII safe even when something goes wrong.
Frequently asked questions
What is the difference between PII and sensitive PII?
PII is any data that can identify a person. Sensitive PII is the subset that could cause real harm if exposed, like a national ID number, financial account details, health records, or biometric data. Non-sensitive PII, such as a name or a workplace, is often public and lower risk on its own. The line matters because sensitive PII deserves stronger handling, including encryption and tighter access.
Is an email address considered PII?
Yes. An email address points to a specific person, especially when it contains a real name, so most privacy laws treat it as PII. The same goes for phone numbers, usernames tied to your identity, and device identifiers. On their own these are usually non-sensitive, but combined with other data they can build a detailed profile.
Is a name alone enough to count as PII?
A full name is PII, though a common name on its own rarely identifies one specific person. The risk rises when it is linked to other details like a date of birth, an address, or an account number. Privacy rules care less about any single field and more about whether the combination can single out a real individual.
How do I keep PII safe when I copy and paste it?
Be aware that the clipboard is shared memory other apps can read, so clear sensitive copies soon after you paste, keep your system patched, and avoid pasting identifiers into untrusted sites or chats. If you keep a clipboard history, use one that is encrypted so saved PII is unreadable to anyone but you. For a one-off, a burn-after-reading note is safer than a plain message.