PII vs personal data: what's the difference between US and EU law?

PII and personal data are not the same thing. PII is the term U.S. law and guidance use for information that identifies a person. Personal data is the European Union's term, and its legal definition is wider. It covers indirect clues too, like a job title or a birth date.

This matters for a document. A file can pass a narrow PII check and still hold personal data under EU law. This article compares the U.S. and EU definitions, as of September 2026, and gives one simple rule for masking a document.

What does PII mean under U.S. law?

The main U.S. reference is NIST Special Publication 800-122, published in April 2010 by the National Institute of Standards and Technology. It was written for U.S. federal agencies, and it defines PII as any information about a person that an agency keeps.

PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

• Some information identifies a person by itself: a full name, a Social Security number, a passport number, a fingerprint.
• Other information only identifies someone once you combine it with something else: a birth date, a job title, a medical record, a salary. NIST groups this second kind under one label, linked or linkable.
• Many U.S. state and sector laws borrow NIST's language, but each one sets its own coverage.

California adds a broader state law. Its privacy statute defines personal information as data that identifies, relates to, or could reasonably be linked, directly or indirectly, with a consumer or household. That already sounds close to the EU standard. California's Civil Code section 1798.140 lists identifiers, browsing history, geolocation, and even inferred profiles.

What does personal data mean under EU law?

Article 4(1) of the EU's General Data Protection Regulation, the GDPR, defines personal data. It means any information relating to an identified or identifiable natural person, called the data subject.

'personal data' means any information relating to an identified or identifiable natural person ('data subject')

Identifiable is the key word. Recital 26 of the GDPR says to check all the means reasonably likely to be used to identify that person, directly or indirectly. That includes the company itself, or anyone else who might try. It also includes the cost and time it would take, given today's technology.

France's regulator, the CNIL, lists common indirect identifiers: a phone number, a license plate, a postal or email address, a voice, or an image. It also warns about combinations. Picture a note about a woman living on a named street, born in 1986, who volunteers for a local charity. No name appears, yet the details together can point to one person, such as Jane Example.

Why is the EU definition broader than U.S. PII?

The three laws point the same direction: identity clues count, not just names and ID numbers. Germany's Bavarian data protection authority, the BayLfD, published a working paper on identifiability in April 2026. It confirms that identification can happen indirectly, through a link that even someone other than the document's owner could make, not only through the data on the page itself.

What should you mask in a document, when in doubt?

If your document could reach an EU reader, or you are simply unsure which law applies, mask to the wider EU standard. It is safer to hide too much than to leave one indirect clue in plain sight.

• Always mask direct identifiers: full names, emails, phone numbers, national ID or Social Security numbers, signatures.
• Also mask indirect identifiers when a small group could be involved: birth dates, postcodes, job titles, account numbers, IP addresses.
• Watch for combinations: a role plus a date plus a location can name someone even without a name.

A tool can help you catch both categories at once. ONYRI Sanitize's detectors run inside your browser and cover direct identifiers, such as names, emails, phone numbers, and national ID numbers, plus many indirect ones, like dates, addresses, and account numbers. Its limit: identification from context alone, such as a rare job title in a small team, still needs a human check before you send the file.

Legal definitions will keep moving as courts test new cases on both sides of the Atlantic. Until they settle, treat any clue that narrows a document down to one person as personal data, whichever law applies.

Frequently asked questions

Sources & references