PII vs Personal Data vs Sensitive Data: Key Differences, Examples, and Compliance Requirements

Personally identifiable information is a US-centric term with no single authoritative legal definition. It is used extensively in federal agency guidance, sector-specific laws, and organizational security frameworks, but its exact scope varies depending on which framework you're reading.

The most commonly cited definition comes from NIST Special Publication 800-122, developed by the National Institute of Standards and Technology: PII is any information that can be used to distinguish or trace an individual's identity — such as name, Social Security number, or biometric records — alone or when combined with other linked or linkable information, such as date and place of birth or mother's maiden name. NIST's definition is explicitly contextual: the same piece of information may or may not constitute PII depending on whether it can realistically be used to identify a specific person, either on its own or in combination with other data.

Most practitioners divide PII into two tiers. Direct identifiers are data elements that identify a person on their own without requiring any additional context: full legal name, Social Security number, passport number, driver's license number, financial account numbers, and biometric identifiers such as fingerprints or facial recognition templates. These are unambiguously PII under every framework that uses the term, and their exposure in a breach is typically reportable to affected individuals and regulators.

Indirect identifiers — sometimes called linked or linkable information — require combination or context to become identifying. IP addresses, device identifiers, advertising IDs, cookie identifiers, location data, behavioral profiles, and demographic information like date of birth or ZIP code can all be indirect identifiers. Whether any of these constitutes PII depends on whether, in the specific context of your processing, they could reasonably be combined with other available data to identify an individual. NIST explicitly includes IP addresses and MAC addresses as potential PII when they can be linked to a specific person or household. This contextual dimension is where organizations most commonly misclassify data — treating indirect identifiers as non-personal simply because they don't directly name anyone.

The sector-specific dimension of US PII adds further complexity. HIPAA defines protected health information as a distinct category that overlaps with PII but is governed by entirely separate rules. The Gramm-Leach-Bliley Act defines nonpublic personal information for financial institutions. The Family Educational Rights and Privacy Act governs education records. COPPA defines personal information for children under 13 with specific enumerated categories. None of these are fully consistent with each other or with NIST's broader definition. The practical implication for any US organization operating across multiple sectors is that PII classification must be performed against the specific laws applicable to each processing context, not against a single generic definition.

What Is Personal Data Under the GDPR?

Personal data is the term used by the General Data Protection Regulation, and its definition is deliberately broader than the traditional US concept of PII. Under GDPR Article 4(1), personal data is any information relating to an identified or identifiable natural person. The critical word is "identifiable" — a person is identifiable if they can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

The breadth of this definition is not accidental. It reflects the GDPR's understanding that modern digital systems can identify individuals through combinations of data points that individually appear innocuous. Browsing history is personal data when it can be linked to a device that can be linked to an individual. An advertising ID is personal data because it persistently identifies a device associated with a person. Location data is personal data because sufficiently precise location records can identify where someone lives and works. Inferred characteristics — credit scores, behavioral profiles, interest segments derived from online activity — are personal data because they relate to an identifiable individual even though they were generated rather than directly collected.

Pseudonymous data is still personal data under the GDPR. Data that has had direct identifiers removed but retains information that could be re-linked to an individual — using a separately held key or through combination with other available data — remains within GDPR's scope. Truly anonymous data, from which all means of re-identification have been irreversibly eliminated, falls outside the regulation, but the GDPR's standard for true anonymization is high and difficult to achieve in practice. The European Data Protection Board has consistently held that organizations claiming anonymization must demonstrate that re-identification is not reasonably possible by anyone, not just by the organization holding the data.

The GDPR does not use the term "PII" anywhere. It was purposefully drafted around the concept of personal data precisely because the GDPR's drafters considered PII too narrow — it was seen as a US legal concept that excluded many categories of information that can identify individuals in digital environments. This distinction matters operationally: an organization that assesses its GDPR obligations using a PII framework rather than a personal data framework will systematically undercount what it is obligated to protect. Online identifiers that US practitioners might not classify as PII — advertising IDs, session cookies, IP addresses, behavioral logs — are almost certainly personal data under the GDPR, and every GDPR obligation applies to them: lawful basis, purpose limitation, retention governance, data subject rights, and breach notification.

What Is Sensitive Data?

Sensitive data is a category within personal data that carries elevated risk and triggers heightened legal obligations. Both the GDPR and US state privacy laws identify specific categories of information that are considered more likely to cause serious harm if mishandled — and impose separate, stricter compliance requirements for those categories.

Under GDPR Article 9, special category data is personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, data concerning a person's sex life, or data concerning sexual orientation. Processing special category data is prohibited by default under Article 9(1). To process it at all, an organization must identify a specific legal basis from the exhaustive list in Article 9(2) — explicit consent, employment law obligations, vital interests, or a limited set of other grounds. This is a fundamentally different legal structure from the ordinary personal data regime, where one of six lawful bases under Article 6 must apply. The additional layer of Article 9 means that organizations processing health data, biometrics, religious beliefs, or other special categories face dual legal basis requirements: they need both an Article 6 lawful basis for processing personal data and an Article 9 condition for processing special category data specifically.

Violations involving special category data consistently receive the highest GDPR fine multiples. TikTok paid €345 million in 2023 for violations related to processing children's data without the heightened safeguards the regulation requires for minors — a category treated with special category-equivalent protection under GDPR's child-focused provisions. Clearview AI has faced €30.5 million in fines and regulatory investigation of potential personal director liability for its systematic collection and processing of biometric facial recognition data without consent.

The US framework for sensitive data takes a different structural approach. The California Privacy Rights Act, which amended the CCPA effective January 1, 2023, introduced a formal "sensitive personal information" (SPI) category as a subset of personal information. CPRA's SPI list includes Social Security numbers and other government-issued identifiers, account login credentials combined with passwords or security codes, precise geolocation data, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of private communications, genetic data, biometric data processed for identification, health information, and information about sex life or sexual orientation. A 2024 California amendment added neural data to the list.

The CPRA's enforcement mechanism for SPI differs fundamentally from the GDPR's. Where GDPR prohibits special category processing by default and requires explicit permission, CPRA creates a consumer right to limit the use and disclosure of their SPI to specified business purposes. Businesses must provide a "Limit the Use of My Sensitive Personal Information" link or combined opt-out mechanism. The burden is on the consumer to invoke the right, not on the business to obtain permission before processing. This is a materially different legal architecture — and organizations that assume CPRA SPI compliance means the same thing as GDPR special category compliance will find gaps in both directions. GDPR is more restrictive at the point of collection; CPRA creates ongoing consumer rights that must be honored operationally.

State laws beyond California have added further definitions. Virginia's Consumer Data Protection Act, Colorado's Privacy Act, Connecticut's Data Privacy Act, Oregon's Consumer Privacy Act, and Maryland's Online Data Privacy Act all define their own sensitive data categories — most require consent before processing sensitive data, making the consent-first model more like GDPR than CPRA. Maryland's law, effective October 1, 2025, goes further: it limits collection, processing, and sharing of sensitive personal information to contexts where it is strictly necessary, not merely permitted with consumer notice. That necessity standard represents a tightening of the regulatory floor that organizations operating nationally must now track.

The Key Differences — and Where They Overlap

The clearest way to understand how PII, personal data, and sensitive data relate is to think about them as three differently sized circles that partially overlap in ways that depend on jurisdiction and context.

PII is the narrowest concept in practice, despite its broad theoretical definition. US law applies it most commonly in specific sectoral contexts — HIPAA's 18 safe harbor identifiers, NIST's guide to federal agencies, breach notification laws in various states — and its scope varies materially between those contexts. A name combined with a ZIP code may or may not be PII under a given state breach notification law. An IP address is PII under NIST's framework but was not historically treated as such under some state laws. PII is predominantly a US term; it has no formal legal status under the GDPR or most international frameworks.

Personal data under the GDPR is broader than PII in almost every dimension. It explicitly covers indirect identifiers, inferred data, pseudonymous data, and combinations of information that together make someone identifiable — even if no single element would do so. An advertising cookie is personal data under GDPR even if it would not be classified as PII under many US frameworks. Location data from an app is personal data under GDPR even at city-level granularity, depending on context. The GDPR's standard is whether identification is possible, not whether it is trivial. Organizations applying a PII lens to their GDPR obligations will systematically undercount their regulated data estate.

Sensitive data — whether GDPR special category or CPRA SPI — is a subset of personal data that sits within the larger circle. All sensitive data is personal data, but the reverse is not true. Health information is both personal data and sensitive data. An email address is personal data but not sensitive data on its own. Biometric identifiers are both personal data and sensitive data. The governance implications of that classification difference are substantial: sensitive data requires separate legal basis analysis, separate consent or opt-out mechanisms, enhanced security controls, more granular retention schedules, and in many jurisdictions triggers mandatory impact assessments before processing begins.

The same piece of data can sit in multiple categories simultaneously depending on context and jurisdiction. A physical location record is personal data under the GDPR if it can identify someone. It is sensitive personal information under the CPRA if it is precise geolocation. It may or may not constitute PII under a given US state breach notification law depending on whether it is combined with a name or other identifier. Processing the same data point thus requires analysis against multiple frameworks simultaneously, and the answer to "what is this?" cannot be resolved by asking it once against a single framework. GDPR data mapping processes that document data elements, their jurisdictional classification, and the applicable legal bases for each processing activity are the operational mechanism through which organizations track these overlapping obligations in a single, current record.

How Different Privacy Laws Classify Data

The GDPR's personal data framework is the broadest and most globally influential. Seventeen Articles, five Recitals, and extensive regulatory guidance from the European Data Protection Board define what constitutes personal data, what requires special category treatment, and what organizations must do at each tier. The GDPR applies not only to EU-based organizations but to any organization processing EU residents' data, regardless of the processor's location. For multinationals, this makes the GDPR the practical floor for global data classification — classify to GDPR standards and you will capture data that lower standards would miss.

HIPAA occupies a distinct US regulatory space. Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity — a healthcare provider, health plan, or healthcare clearinghouse — or by a business associate. HIPAA's 18 safe harbor identifiers define a specific list of elements that must be removed before health data can be considered de-identified. PHI is a narrower concept than GDPR's health data category in some respects — it applies to covered entities and their business associates specifically, not to every organization that collects health information — but the obligations for covered entities around PHI are prescriptive and extensive. Critically, data that falls outside HIPAA's covered entity scope is not necessarily unregulated: health information collected by a consumer app, a wearable device manufacturer, or a retailer's wellness program is not PHI, but it is likely sensitive personal information under CPRA and health data under GDPR, subject to those frameworks' heightened obligations instead.

The emerging US state privacy landscape adds granular variations on these definitions. Colorado's law requires opt-in consent for processing sensitive data. Virginia requires the same. Connecticut, Utah, and Oregon all define sensitive data categories that largely mirror GDPR special categories while adding their own specific elements. Oregon's amendments, effective January 1, 2026, include precise geolocation as sensitive regardless of whether it is combined with other information. The Maryland law's necessity-based standard for sensitive data is the most restrictive yet enacted — it is not enough to disclose sensitive data collection; the collection must be demonstrably necessary for the service being provided.

Financial data occupies a cross-cutting position. Financial account numbers, payment card credentials, and banking information are sensitive personal information under CPRA, covered by GLBA's nonpublic personal information definition for financial institutions, and personal data subject to GDPR's general framework when they relate to EU residents. An organization processing financial data across all three contexts doesn't choose which law applies — all three apply simultaneously, with compliance measured against the most demanding provision in each area.

Organizations that have implemented Records of Processing Activities under GDPR Article 30 have a structural advantage in managing this complexity: the ROPA requires documenting not just which personal data is processed but what categories, for what purposes, on what legal basis, with what retention schedule, and shared with which processors. That documentation discipline, applied to every processing activity, builds the classification visibility that governance programs need. The ROPA is mandatory under GDPR for any organization with more than 250 employees, and for any smaller organization that processes special category data or criminal conviction data — which means most organizations processing health, biometric, or religious information are legally required to have it.

Classification's Direct Impact on Governance Controls

The governance obligations that attach to data vary systematically by classification, and misclassification directly causes incorrectly calibrated controls.

Retention is the clearest example. Personal data under the GDPR must be retained only as long as necessary for the purpose for which it was collected — the storage limitation principle of Article 5(1)(e). Special category data warrants shorter retention periods and more granular justification. CPRA requires businesses to disclose how long they intend to retain sensitive personal information and limits retention to what is necessary to fulfill the disclosed purposes. An organization that classifies health survey data as generic user information and applies a three-year default retention schedule has almost certainly violated both frameworks. GDPR data retention obligations require retention schedules to be set by data category, justified by processing purpose, documented in the ROPA, and technically enforced — not applied generically across all user data regardless of category.

Consent requirements vary by classification in ways that directly affect product architecture. Personal data under GDPR requires one of six lawful bases; consent is one option but legitimate interest and contractual necessity cover many standard use cases. Special category data under GDPR requires explicit consent unless a specific Article 9(2) exception applies — legitimate interest is not available for special categories, regardless of how it would apply to ordinary personal data. CPRA sensitive personal information requires a right-to-limit mechanism that ordinary personal information does not. This means a product that collects both ordinary personal data and sensitive data in the same flow needs differentiated consent and disclosure architecture for each category, not a single bundled consent.

Breach notification thresholds are calibrated to data classification in every major framework. GDPR's 72-hour notification to supervisory authorities applies to all personal data breaches meeting its risk threshold, but violations involving special category data escalate directly to the highest notification priority because of the greater potential harm to affected individuals. HIPAA's breach notification safe harbor for de-identified data turns on whether PHI-specific de-identification standards have been met — not generic anonymization. State breach notification laws across the US define notification triggers by data category, with sensitive categories like SSNs, financial credentials, and biometric data typically triggering mandatory notification regardless of context. An organization that hasn't correctly classified its data cannot correctly assess whether a breach meets the notification threshold.

Security controls must be calibrated to data sensitivity. Encryption requirements, access controls, audit logging, and penetration testing scope all scale with the sensitivity of the data being protected. An organization that applies the same security configuration to a database containing names and email addresses and to a database containing health records, biometric templates, or sexual orientation data has mismatched its controls to its risk profile. Regulators have specifically fined organizations for applying inadequate security controls to sensitive data that was incorrectly classified as general personal data — the Uber €290 million fine included findings about inadequate safeguards applied to sensitive driver health and criminal record data that had not been appropriately classified and segregated.

Building a Data Classification Framework That Works

The gap between knowing what these categories mean legally and having a classification system that accurately categorizes your organization's actual data is an operational gap — one that requires documented processes, tooling, and governance ownership.

Start with a complete data inventory. Before you can classify data, you need to know where it lives. That means mapping every system that collects, stores, or processes personal data: production databases, SaaS applications, data warehouses, analytics platforms, backup systems, vendor APIs, AI training environments, and any other system that receives user or employee data. For each system, document the data elements, who has access, what the data is used for, where it flows, and how long it is retained. The output of this exercise directly feeds your GDPR Records of Processing Activities and provides the data estate visibility that accurate classification requires. Without a complete inventory, classification is guaranteed to be incomplete.

Apply classification at the data element level within processing activities. It isn't sufficient to classify a "customer database" at the system level — the database contains dozens of data elements, each of which may warrant different classification under different frameworks. Name and email address: personal data under GDPR, personal information under CCPA, PII under NIST. Health survey responses embedded in the same database: special category data under GDPR, sensitive personal information under CPRA. Classification must be granular enough to trigger differentiated governance controls for each category.

Establish cross-functional ownership. Classification decisions sit at the intersection of legal knowledge, data architecture understanding, and operational context that no single team holds alone. Legal knows the regulatory definitions. Engineering knows what data is actually in each field. Privacy and compliance know the governance obligations that attach to each classification. Embedding classification review into product and data pipeline development processes — before new data collection goes to production, not after — is the only way to keep classification current in a dynamic environment.

Automated privacy governance platforms that combine data discovery, classification automation, ROPA maintenance, and DPIA workflows offer the infrastructure for scaling this approach across complex data estates. Machine learning-based classification can identify PII, special category data, and financial information in unstructured data sources — flagging health information in freetext fields, identifying biometric data in uploaded files, detecting government identifiers in form inputs — that manual classification processes would miss. Critically, automated tools can trigger alerts when sensitive data appears in unexpected locations or when integration scope changes suggest new processing purposes that should be assessed before going live.

Frequently Asked Questions

What is the difference between PII and personal data?

PII is primarily a US concept defined by NIST and various sector-specific laws as information that can be used to identify a person directly or in combination with other data. Personal data is the GDPR's term, defined more broadly to include any information relating to an identified or identifiable natural person — including indirect identifiers like IP addresses, advertising IDs, and behavioral profiles that the traditional PII concept may not cover. In practice, GDPR's personal data category is wider: data that would not constitute PII under many US frameworks will still be personal data under GDPR.

Is personal data broader than PII?

Yes, in most practical contexts. The GDPR's "identifiable natural person" standard sweeps in pseudonymous data, online identifiers, inferred characteristics, and combinations of information that together make someone identifiable — even if no single element would. US PII frameworks, particularly in their narrower sectoral applications, often focus on direct identifiers and miss the indirect identification risk that the GDPR explicitly covers.

What counts as sensitive personal information under US law?

It depends on the law. Under CPRA, sensitive personal information includes government identifiers, financial credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, private communications, genetic data, biometrics, health information, sexual orientation data, and neural data. Most other comprehensive US state privacy laws define similar categories, typically requiring opt-in consent before processing. HIPAA protects a distinct category — protected health information — for covered entities and their business associates specifically.

Is an IP address personal data?

Under GDPR, yes. The Court of Justice of the European Union confirmed in 2016 that a dynamic IP address constitutes personal data when the website operator has legal means available to identify the individual associated with it. Under US PII frameworks, an IP address may or may not be PII depending on the specific framework — NIST includes it as potential PII; some state breach notification laws do not. For any organization subject to GDPR, treat IP addresses as personal data.

Is biometric data sensitive data?

Yes, under both GDPR and CPRA, when processed for the purpose of uniquely identifying a natural person. A photograph of a person is personal data but is not automatically special category data. The same photograph processed through a facial recognition system to generate a facial template that uniquely identifies the individual — that template is biometric data processed for identification and triggers special category treatment under GDPR Article 9 and sensitive personal information treatment under CPRA.

What is the difference between PII and PHI?

PII is a broad US concept covering any data that can identify an individual. PHI — protected health information — is a specific subset defined under HIPAA as individually identifiable health information held or transmitted by a covered entity or business associate. PHI is PII, but PII is not necessarily PHI. Health data collected outside HIPAA's covered entity scope — by a fitness app, a retail pharmacy loyalty program, or an employer wellness initiative — is not PHI but is special category health data under GDPR and sensitive personal information under CPRA.

Can the same data be both personal and sensitive?

Yes, always. Sensitive data is always a subset of personal data — it cannot be sensitive without first being personal. Health records are personal data and sensitive data. A sexual orientation disclosure is personal data and sensitive data. A name on its own is personal data but not sensitive data. The classification question for sensitive data is whether the data element falls within a defined sensitive category under the applicable law, layered on top of the baseline question of whether it is personal data at all.

What happens if data is misclassified?

Misclassification produces downstream governance failures: incorrect legal bases are applied, consent mechanisms are designed without accounting for heightened requirements, retention schedules don't reflect the shorter periods warranted for sensitive categories, security controls are under-calibrated for the actual risk, and breach notification obligations may not be triggered even when they should be. Regulators assess violations not just by outcome but by whether classification and governance processes were adequate. Organizations that couldn't demonstrate reasonable classification methodology face significantly higher penalties than those that had documented processes and made good-faith classification errors.

Conclusion: Classification as Operational Governance

The most consequential thing to understand about PII, personal data, and sensitive data is that they are not just definitional distinctions for legal teams — they are the upstream inputs that determine what every other governance control should look like. Retention schedules, consent architecture, security configurations, breach notification procedures, Data Protection Impact Assessment obligations, vendor contract terms, and subject rights fulfillment workflows all vary by data classification. An organization whose classification program is incomplete, inconsistent, or frozen in time has built all of those controls on a flawed foundation.

The enforcement environment makes this operationally urgent. €1.2 billion in GDPR fines in 2025 alone, 443 breach notifications per day, CPRA penalties of $7,988 per intentional violation, and an expanding wave of US state laws with their own sensitive data categories — the cost of getting classification wrong has never been higher, and the regulatory surface has never been broader.

Audit your regulated data estate against all three classification tiers. Build your ROPA to capture data category, not just processing activity. Apply differentiated governance controls — retention, consent, security, DPIA — that reflect the actual sensitivity of each data element. Keep classification current as your data estate changes. That discipline is not optional compliance hygiene. It is the operational foundation on which everything else depends.