Personally Identifiable Information (PII) is any data that can be used, on its own or in combination with other information, to identify, locate, or contact a specific individual. It encompasses a wide range of data about people, and protecting it is a central concern of information security and privacy, because PII is both highly sensitive to individuals and highly valuable to attackers. Much of what security programs, data-protection regulations, and API security controls aim to protect is, at its core, PII.
PII is often divided into direct and indirect identifiers. Direct identifiers can identify a person by themselves – for example, full name, government-issued identification numbers (such as Social Security or national ID numbers), passport numbers, driver’s license numbers, email addresses, and phone numbers. Indirect identifiers may not identify someone alone but can do so when combined with other data – for example, date of birth, gender, postal code, or place of birth, which together can pinpoint an individual. Some categories are especially sensitive, such as financial information, health and medical records, biometric data, and login credentials, and often receive heightened protection.
PII matters in security because it is a primary target of cyberattacks and a primary subject of regulation. Attackers seek PII to commit identity theft, fraud, and further attacks, and to sell on illicit markets. Data breaches are frequently measured and reported in terms of how many individuals’ PII was exposed. Regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), among many others worldwide, impose legal obligations on organizations to protect PII, restrict how it is collected and used, and require notification when it is breached – with significant penalties for failures.
In the API context, PII protection is particularly important and challenging. APIs frequently transmit and expose personal data, and API-specific vulnerabilities can lead directly to PII exposure. Broken Object Level Authorization can let attackers harvest other users’ personal records; excessive data exposure can leak sensitive fields in API responses; and leaking or poorly inventoried APIs can expose PII without anyone noticing. Because APIs handle so much personal data programmatically, ensuring that they expose only the necessary PII to authorized parties is a core security responsibility.
Protecting PII involves multiple practices: knowing where PII resides (data discovery and classification), minimizing collection and retention to only what is necessary, encrypting PII at rest and in transit, enforcing strict access controls and authorization so only authorized parties can access it, limiting what APIs return (data minimization and property-level authorization), monitoring for unauthorized access and exfiltration, and complying with applicable privacy regulations. Ultimately, because PII represents real people and real risk to them, safeguarding it is both a security imperative and a legal and ethical obligation.