Define PII and why it must be safeguarded.

• A. Personally Identifiable Information; data that can identify an individual and requires protection against misuse.
• B. Publicly Indexed Information; information available in public sources.
• C. Personal Internal Insight; internal opinions about a person.
• D. Physical Identifying Information; biometric data only.

Answer: (A)

PII refers to information that can identify a specific person, and it must be safeguarded because misuse of such data can invade privacy, enable identity theft or fraud, lead to financial or reputational harm, and create legal or regulatory consequences for organizations handling it. This type of data isn’t limited to one kind; it includes names, contact details, government IDs, financial information, biometric data, and even data that, when combined with other information, could identify someone. The goal of protection is to limit who can access it, ensure it’s accurate, and prevent unauthorized use or disclosure.

Publicly indexed information isn’t inherently protected because it’s already accessible, and the risk/problem with PII is that it can identify someone even if it’s not obviously sensitive on its own. Internal opinions about a person aren’t about identifying that person, and biometric data, while important, is only part of PII and does not cover all the types of data that can identify someone.