Personally identifiable information (PII) is information that can be used to distinguish or trace a person’s identity, either on its own or when combined with other linked or linkable information. The term is common in US law and standards. In the EU, the GDPR uses the broader term personal data: any information relating to an identified or identifiable natural person.

Examples

• Direct identifiers: full name, national ID or passport number, email address, phone number, biometric records.
• Linkable data: date and place of birth, postal address, IP address, device IDs and location data, which can identify someone when combined.
• Sensitive categories: health, financial and account data, which carry higher risk if exposed.

Whether data counts as PII depends on context. A first name alone may not identify anyone, while a first name plus an employer and a city may.

Why it matters for dark web monitoring

PII is one of the main goods in criminal markets. Leaked customer and employee records are used for social engineering, identity fraud, account takeover and targeted phishing. When PII from an organization appears on the dark web, it may trigger breach notification duties under laws such as the GDPR. Monitoring services watch for leaked records so that affected people and regulators can be informed in time.

Sources: NIST CSRC Glossary: personally identifiable information, EUR-Lex: Regulation (EU) 2016/679 (GDPR)