Personally Identifiable Information
also called PII, Personal Data
Data relating to an identifiable person — a category far broader than name and address, and the trigger for most regulatory obligation.
The scope surprises people, and getting it wrong is how personal data ends up somewhere it should not be. Under GDPR "personal data" includes anything relating to an identifiable natural person: name, email, phone, address, but also IP address, device identifier, cookie ID, location, and any pseudonymous identifier that can be linked back with additional information.
Two consequences architects meet directly. Logs and telemetry are usually in scope — an access log containing IP addresses is personal data, which affects retention, where it may be stored, and which third-party observability vendor may process it. And re-identification matters: a dataset stripped of names may still identify individuals through combinations of attributes, so "we anonymised it" is a claim that requires testing rather than asserting.
Special categories — health, biometrics, ethnicity, political opinions, sexual orientation — carry stricter requirements and should be isolated architecturally rather than sitting in the same table as everything else.
The practical starting point is a data classification applied at the schema and stream level, because every downstream control depends on knowing which fields are which.