Personally identifiable information (PII) is any data that can identify a specific individual, either on its own or when combined with other information. It includes direct identifiers such as names, Social Security numbers, email addresses, and phone numbers, along with indirect identifiers, like date of birth, ZIP code, or IP address, that can single out a person when linked together. Organizations detect, protect, and often redact or de-identify PII to comply with privacy regulations such as GDPR, HIPAA, and CCPA.
Direct and indirect identifiers
PII falls into two broad categories. Direct identifiers name a person outright: full name, Social Security number, passport number, email address, or phone number. Indirect identifiers, also called quasi-identifiers, reveal nothing in isolation but can pinpoint an individual when combined. Date of birth, ZIP code, and gender are a classic example: together they uniquely identify a large share of the U.S. population, even though no single one of them is identifying on its own.
Regulations draw the boundary differently. GDPR uses the broader term "personal data," HIPAA governs "protected health information" (PHI), and U.S. state laws such as CCPA keep their own definitions. The practical takeaway is consistent across all of them: any field that can trace back to a real person is sensitive and has to be handled accordingly.
Why detecting PII is hard
PII is often straightforward to find in a structured database, when columns are clearly labeled like email or ssn. It is far harder to find in unstructured data, the free text of support tickets, chat logs, clinical notes, PDFs, and transcripts, where a name or account number can appear anywhere, in any format, with no label to flag it. That is where most PII actually lives, and where most privacy exposure happens. Detecting it reliably takes named entity recognition (NER) that reads context, not simple pattern matching, because not every nine-digit number is a Social Security number and not every capitalized word is a name.
How Tonic.ai addresses this
Tonic Textual detects PII in unstructured data, support tickets, clinical notes, PDFs, and transcripts, using proprietary named entity recognition models, then redacts or replaces it with realistic synthetic values, so teams can use free-text data safely in AI development. Tonic Structural handles PII in structured databases with its own sensitivity scan, which flags PII and PHI columns using built-in sensitivity types, an AI model that scores table and column names by semantic similarity, and custom rules for proprietary data, then masks or de-identifies those columns while preserving referential integrity. Together, they cover the broader PII redaction workflow across both unstructured and structured data, from Textual's PII detection and NER to regulated use cases in healthcare and life sciences.
