What is PII?

In practice

The controls that matter are knowing where it is, limiting who can reach it, minimising what is collected in the first place, and redacting or tokenising it before it is sent anywhere it does not need to go. Documents are the usual blind spot: a contract or a CV sent to a model carries far more personal data than the database field anyone was worrying about.

Where it fits in a build

Relevant to any system handling customers, staff, applicants or the public. Special categories — health, biometrics, beliefs — carry stricter obligations and should be identified explicitly at design time.

Common mistakes

• Sending whole documents to a model when a redacted extract would do.
• Personal data in application logs, where it is retained far longer than the policy says.
• Copying production data into test environments.

Related terms

• Data processing agreement (DPA)
• Data residency
• Least privilege

Working on something that involves this?

ASTACKRA designs and builds AI systems, automation and custom software for businesses that need technology shaped around their own workflow. If this term turned up in a proposal and you want a straight answer about whether it applies to your situation, ask us — no obligation, and we will tell you if the answer is no.