What does PII stand for?
PII stands for Personally Identifiable Information. Personally identifiable information: data that identifies a person, such as name, address or ID numbers. A breach involving it can trigger legal notification duties.
PII is any information that can identify a specific person, either alone or when combined with other information. A full name with a passport number, a national identification number, a home address, a fingerprint or an account number are direct examples. A date of birth or a postcode may not identify anyone alone but becomes PII when linked to other data. Organizations are expected to know where PII is stored, collect only what they need, restrict who can read it and protect it in storage and in transit.
PII in practice: an example
A support technician is asked to send a customer database to an outside developer for testing. The table holds names, home addresses and dates of birth. The correct step is to replace those fields with generated test values before the copy leaves the company, because the developer does not need real people's data to test the software.
What PII is confused with
PII vs PHI: what is the difference?
Protected health information is the health-related subset: data about a person's health, care or payment for care that can be tied to that person. All PHI is personal data, but most PII is not PHI.
PII vs PCI DSS: what is the difference?
PCI DSS is a security standard for payment card data. A card number is personal data, but the standard covers card data specifically, not PII in general.
Which exams cover PII?
PII is on the official CompTIA acronym list for two of the four exams covered here.
- CySA+ CS0-004: on the acronym list, not tied to one objective.
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security); 220-1202 4.0 (Operational Procedures).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which item is PII when stored on its own?
- The model number of a printer
- A national identification number
- The company's public phone number
- The current date
Show the answer
B. A national identification number. A national identification number points to exactly one person. The other items identify equipment or a company, or nobody at all.
2. A technician must dispose of a hard drive that held customer records containing PII. What should happen first?
- Sell the drive online as it is
- Sanitize or physically destroy the drive according to policy
- Rename the folders on the drive
- Move the drive to an unlocked drawer
Show the answer
B. Sanitize or physically destroy the drive according to policy. Personal data must be made unrecoverable before the media leaves the organization's control. Renaming or storing the drive leaves the data readable.
Sources: NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII); NIST glossary: personally identifiable information; NIST glossary: protected health information. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.