08 / Trust & Governance
PII
Personally identifiable information: anything that identifies a person, such as a name, email address, ID number or health record. In Europe the legal term is personal data, and it is broader.
How you’ll hear it
“Can I paste this complaint into the chatbot?”
“Not with the customer’s details in it. Remove the PII first.”
Avoid
Pasting customer or employee details into tools the organisation has not approved.
The longer version
Personal data needs a lawful basis, a clear purpose and safeguards wherever it goes, including into AI tools. The practical risks are data leaving the organisation through unapproved tools, and models revealing information they were given. Redaction, approved tools and clear rules are the everyday defences.
In depth
PII, personally identifiable information, is any information that identifies a person: a name, an email address, an ID number, a photo, a health record. In Europe the legal concept is personal data, which is broader and includes anything relating to an identifiable person.
AI raises the stakes in two ways. First, people paste personal data into AI tools during everyday work, often tools the organisation has not approved. Second, systems given personal data may reveal it later, in answers to other users or in logs kept by the provider.
The rules do not change because a tool is new. Processing personal data needs a lawful basis, a defined purpose, appropriate security and, where it leaves your jurisdiction, suitable safeguards.
Most incidents are not sophisticated. They are someone pasting a spreadsheet into the wrong tool.
What to do
- Tell staff plainly which tools may receive personal data and which may not.
- Use redaction or anonymisation before personal data reaches an AI system where you can.
- Check each provider’s retention and training terms before approving it for personal data.