An organization cannot properly protect PII it does not know about. This document uses a broad
definition of PII to identify as many potential sources of PII as possible (e.g., databases, shared network
drives, backup tapes, contractor sites). PII is ―any information about an individual maintained by an
agency, including (1) any information that can be used to distinguish or trace an individual‘s identity,
such as name, social security number, date and place of birth, mother‘s maiden name, or biometric
records; and (2) any other information that is linked or linkable to an individual, such as medical,
educational, financial, and employment information.‖ 6
Examples of PII include, but are not limited to:
Name, such as full name, maiden name, mother‘s maiden name, or alias
Personal identification number, such as social security number (SSN), passport number, driver‘s
license number, taxpayer identification number, or financial account or credit card number
Address information, such as street address or email address
Personal characteristics, including photographic image (especially of face or other identifying
characteristic), fingerprints, handwriting, or other biometric data (e.g., retina scan, voice signature,
facial geometry)
Information about an individual that is linked or linkable to one of the above (e.g., date of birth, place
of birth, race, religion, weight, activities, geographical indicators, employment information, medical
information, education information, financial information).