What is PII? What counts as personally identifiable information in a spreadsheet

PII stands for personally identifiable information. This guide explains what the term means, how the main laws describe it in different words, which spreadsheet columns count, which easily forgotten ones do too, and how to review a file before you share it.

Before you can protect the personal information in a file, you have to know what it is. A column called "Name" is easy. A column called "Ref", "Notes" or "Device" may hold as much, and a file can contain personal information even when no single value looks private.

This guide explains what PII means, how the main laws describe it, which kinds of columns count, and how to review a file before it leaves your hands.

Key terms

PII: short for personally identifiable information, which is information that identifies a person or can be linked to one. The laws use different names for the idea, such as "personal data" and "personal information".
Identifier: a value that points to a person, such as a name, an email address, a phone number or an account number.
Indirect identifier: a value that points to a person only in combination with others, such as a postal code together with a birth date and a job title.
Sensitive category: a kind of information that laws treat with extra care, such as health, religion or biometric data.
Record: one row of a spreadsheet, usually about one person, order or event.

What does PII stand for, and what does it mean?

PII stands for personally identifiable information. In short, it is information that tells you who a person is, or that can be tied to a person once you combine it with something else.

PII is a common shorthand, and it is not the legal term in every law. The federal student privacy rule uses "personally identifiable information" itself. The European Union's data protection law uses "personal data", and California's privacy law uses "personal information". Each describes a slightly different set of information, so a single answer to "is this PII?" does not fit every file.

Why do different laws use different words?

Because each law was written for a different purpose. Three definitions show the range.

The European Union's General Data Protection Regulation speaks of "personal data": any information relating to an identified or identifiable person. A person is identifiable if they can be identified directly or indirectly, for example by a name, an identification number, location data or an online identifier.
California's privacy law speaks of "personal information": information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a person or a household. Its examples include a real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number and passport number. The attorney general's guide adds records of products purchased, browsing history, geolocation data and fingerprints.
Sector rules define their own terms. The federal rule on health information lists eighteen kinds of identifiers. The federal rule on student records lists the student's name, the names of parents and family members, addresses, personal identifiers such as a student number, and indirect identifiers such as the date of birth. See the HIPAA identifiers, column by column and student data and AI.

The wording differs, but the three share an idea that matters for a spreadsheet: information counts when it can be linked to a person, not only when it names one.

What are examples of PII in a spreadsheet?

Kind of column	Examples	Why it counts
Names	Full name, first name, surname, contact, signatory	It names the person
Contact details	Email, phone, street address, postal code, social media handle	It reaches the person or places them
Numbers that identify	Customer number, employee number, student number, account number, passport or social security number, license plate	Anyone who holds the lookup list can find the person
Online and device identifiers	IP address, device ID, cookie ID, user ID	It ties activity to a person's device
Dates and places about a person	Birth date, hire date, appointment date, hometown, location	It narrows the group the person could be in
Descriptions	Job title, department, salary, grade, diagnosis, nationality	Alone it may be shared by many people, but in a small group it may be unique
Records of behavior	Purchases, clicks, messages, ratings, tickets	It describes what a person did, and may identify them through the pattern
Free text	Notes, comments, ticket text, descriptions	People write names, numbers and stories into sentences

Which columns are easy to forget?

Timestamps. The exact time of a purchase or a login, together with a date, can match a person to an entry in another system.
Internal numbers. An order number looks harmless, but anyone with access to the order system can look up the customer. Treat it with the same care as a name.
Small categories. A department with one person in it, or a rare job title, points to that person.
Row order. If a file is sorted by hire date or sign-up date, the position of a row says something about the person.
Hidden parts of the workbook. Comments, hidden sheets and document properties can hold names. See hidden data in Excel files.

What is sensitive PII?

Several laws name kinds of information that need extra care. The European regulation lists, among others, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health, and sex life or sexual orientation. California's list of sensitive personal information includes government identifiers such as social security numbers, financial account numbers with their access codes, precise geolocation, and the contents of mail, email and text messages. It also includes genetic data, and information about health, sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, and union membership.

A spreadsheet may hold such information without a column that says so. A "Reason for absence" column can reveal health, and a "Dietary requirement" column can reveal religion. When a column of this kind is not needed for the question you want answered, remove it.

What is not PII, and does public information count?

Sometimes public information does not count, and the answer depends on the law. California's definition of personal information leaves out publicly available information. The attorney general gives records from federal, state or local government, such as professional licenses and property records, as examples. It also includes information that a business has a reasonable basis to believe the consumer lawfully made available to the general public.

The European regulation has no such exclusion in its definition of personal data. A name and a job title that you found on a website are therefore not automatically free to share in a file. Ask your privacy adviser which rule applies to you.

The European definition covers natural persons, so facts about a company alone, such as its registered address or turnover, fall outside it. The name of a contact at that company falls inside it.

How do you review a file for PII?

How can DataAttendant help?

DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file, and it looks for personal details by the values in a column and by its heading. It recognizes, for example, email addresses, phone numbers, IP addresses, web addresses, bank account numbers, birth dates, names, postal addresses and postal codes, and it proposes a treatment for each. You see a preview, change any choice, and review what remains before you download the protected copy. It cannot find everything, and it does not decide what your law counts as PII, so the review above still applies. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps.

Sources

Regulation (EU) 2016/679 (General Data Protection Regulation), Article 4(1) (definition of personal data) and Article 9 (special categories). Read on gdpr-info.eu on 28 October 2026.
California Civil Code § 1798.140, definition of "personal information" (subdivision (v)). Read on the California Legislative Information site on 28 October 2026.
State of California Department of Justice, Office of the Attorney General, "California Consumer Privacy Act (CCPA)", frequently asked questions 3 and 4. Page updated 28 August 2026; read 28 October 2026.
34 CFR § 99.3 (definition of personally identifiable information in education records) and 45 CFR § 164.514(b) (the eighteen identifiers), both read on law.cornell.edu on 28 October 2026.