Personal data is broader than PII. It includes any information that can identify a person directly or indirectly, even when the identifier is only visible in context. PII is typically used in the US and is narrower. In practice, if different data points can be combined to single out a person, the information should be treated as personal data.
How GDPR and PII differ in practice
GDPR uses a legal scope test, not a data-label test. The practical question is whether the information relates to an identifiable person, directly or indirectly, in the context of processing. PII is a narrower, more US-centric term, so a dataset can be personal data under GDPR even when an organisation would not casually call it PII.
That distinction matters because the same record can move in and out of scope depending on context. A name, email address, device identifier, location trail, or customer reference number may be low-risk alone, but become personal data once it can reasonably identify or single out someone.
For a working GDPR definition, the key point is that identifiability is contextual. The EU General Data Protection Regulation (GDPR) treats direct identifiers and indirect identifiers under the same legal lens when they can point to a person with reasonable means.
Why the broader GDPR concept changes data handling
Because GDPR is broader than PII, teams should not wait for a classic identifier before applying privacy controls. If separate fields, logs, or datasets can be combined to identify someone, the safer assumption is that the material is personal data and should be governed accordingly.
That is especially important for analytics, support tooling, product telemetry, and incident records. In those settings, a single field may not look sensitive in isolation, but the combination of timestamps, account references, IP addresses, support notes, and business context can create a person-level record.
For governance and inventory work, Data Mapping and ROPA Guide helps teams trace where identifiable data lives, how it flows, and which processing records need to stay current.
For regulatory context across privacy and security obligations, Identity Security Regulatory Map shows how GDPR fits alongside other control frameworks when identity data, access records, and governance duties overlap.
When to treat something as personal data even if it looks like PII
The safest operational rule is to assess identifiability from the recipient's or processor's perspective, not from the label on the field. If your organisation, a partner, or an attacker could reasonably use the data to identify a person, then it should be treated as personal data for GDPR purposes.
This is why pseudonymised data still often remains in scope. Removing a direct name does not remove GDPR obligations if re-identification is still possible through linkage, context, or auxiliary information. The practical test is whether the identification risk has been reduced enough to change the legal treatment, not whether the obvious identifier disappeared.
For support when the data set contains identity-related content, Identity Data Privacy and Consent Guide covers minimisation, lawful handling, retention, and the privacy implications of data that can identify people indirectly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.5 — Principles relating to processing of personal data | Defines lawful processing and identifiability under GDPR |
| Art.25 — Data protection by design and by default | Requires privacy controls when data can identify people in context | |
| Art.32 — Security of processing | Covers protection measures for personal data throughout processing | |
| Recommendation — Apply Article 5 principles to classify and minimise data that can identify a person indirectly. Build privacy into collection, storage, and sharing for data that may become identifiable. Protect personal data with appropriate technical and organisational security controls. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Helps define which data and processes fall within privacy governance scope |
| Recommendation — Document where personal data is used so governance decisions reflect actual processing context. | ||
| NIST SP 800-53 Rev 5 | PT-2 — Authority to Process Personally Identifiable Information | Directly addresses deciding when PII-like data may be processed |
| AU-2 — Audit Events | Supports logging and traceability for personal data processing | |
| Recommendation — Require explicit authority and documented purpose before processing identifiable personal data. Log access and processing events that affect identifiable personal data. | ||
Practitioner Guidance
What to verify: Check whether the data can identify, single out, or be linked back to a person when combined with other fields, even if no direct name is present. That is the practical threshold that decides whether GDPR treatment is required.
Decision rule: If the record can reasonably be tied to an individual by your organisation, a vendor, or another likely recipient, handle it as personal data first and narrow the scope only if you have a documented basis for doing so.
Common mistake: Treating PII as if it were the full GDPR test. That shortcut often leads teams to miss logs, pseudonymous identifiers, and joined datasets that still sit within GDPR scope.
Practitioner takeaway: Use “personal data” as the governing GDPR concept and treat “PII” as a narrower shorthand, not as a safe boundary for compliance decisions.
Related resources from NHI Mgmt Group
- How should security teams control personal data sharing with third parties under GDPR?
- How should organisations govern personal-data access in GDPR programmes?
- Who is accountable when a processor mishandles personal data under GDPR?
- How should organisations manage both HIPAA and GDPR when the same system handles personal data?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org