A US buyer's security questionnaire may ask about PII, short for personally identifiable information, where a UK buyer's asks about personal data. The US National Institute of Standards and Technology (NIST) starts broad: "any information about an individual maintained by an agency." That wording appears in NIST SP 800-122, the Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), published in April 2010.

The NIST definition in full

SP 800-122 quotes a definition from the US Government Accountability Office. PII is "any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information."

The NIST online glossary gives a shorter version drawn from US government guidance: "Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual."

The glossary version turns on two ideas.

The first is "trace". SP 800-122 explains it with a SaaS-familiar example: "To trace an individual is to process sufficient information to make a determination about a specific aspect of an individual's activities or status. For example, an audit log containing records of user actions could be used to trace an individual's activities." A product's audit log is therefore something a buyer's privacy team may treat as holding PII.

The second is "linked or linkable". NIST separates the two. Linked information "is logically associated with other information about the individual." Linkable information is information "for which there is a possibility of logical association with other information about the individual." The document's example is two databases holding different PII elements, where "someone with access to both databases may be able to link the information from the two databases and identify individuals."

The UK term is personal data

A UK buyer working under UK GDPR will talk about personal data. The Information Commissioner's Office (ICO) guidance on what personal information is opens: "Personal data is information that relates to an identified or identifiable individual."

The ICO lists what can identify someone: "a name or a number or could include other identifiers such as an IP address or a cookie identifier, or other factors." It adds that "'Online identifiers' includes IP addresses and cookie identifiers which may be personal data."

The guidance also draws a line between pseudonymised and anonymous data. "Information which has had identifiers removed or replaced in order to pseudonymise the data is still personal data for the purposes of UK GDPR." And "Information which is truly anonymous is not covered by the UK GDPR." The ICO also notes that "the same information is personal data for one controller's purposes but is not personal data for the purposes of another controller."

When a UK questionnaire asks about personal data, answer in those terms. The contract that governs that data, the data processing agreement, has its own set of buyer questions.

How NIST rates the risk

SP 800-122 does not treat all PII the same. It asks organisations to assign a "PII confidentiality impact level—low, moderate, or high" based on the potential harm if the data were exposed. The factors it lists include identifiability, quantity of PII, data field sensitivity, context of use, obligations to protect confidentiality, and access to and location of PII.

Context of use has the clearest example in the document. Two lists hold the same fields, "name, address, phone number". One is "people who subscribe to a general-interest newsletter produced by the organization, and the second list is people who work undercover in law enforcement." NIST's conclusion is that "the potential impacts to the affected individuals and to the organization are significantly different for each list."

For a SaaS product, the same reasoning means a buyer's risk rating depends on what they plan to put into it. A CRM field holding work email addresses and one holding health notes are both PII under the NIST definition, and the questionnaire answers will differ.

Collect less, keep less

SP 800-122 states: "Organizations should minimize the use, collection, and retention of PII to what is strictly necessary to accomplish their business purpose and mission." It also says the "likelihood of harm caused by a breach involving PII is greatly reduced if an organization minimizes the amount of PII it uses, collects, and stores."

A privacy reviewer may ask which fields your product requires, which are optional, and how long each is kept. For the last of those, see what a data retention policy sets out.

SP 800-122 also describes de-identification as one of its safeguards. "Organizations can de-identify records by removing enough PII such that the remaining information does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual." It gives a use for such records: "examinations of correlations and trends." If your product offers aggregate reporting or analytics exports, this is the NIST passage that applies to them. The ICO's line on pseudonymised data sits beside it for a UK buyer, because removing or replacing identifiers alone leaves the data inside UK GDPR.

Take a hypothetical buyer, Northwind, reviewing a call-recording feature. Their reviewer asks whether recordings contain PII. SP 800-122's list of personal characteristics includes "voice signature" among its examples of biometric data, so the voice in a recording may itself fall within NIST's examples. If the recordings also carry participants' names, the same file holds a name, which is the first item on NIST's list of examples.