PII Removal › What Counts as PII

PII spans a wide range of information types, and the definition differs depending on context and intended use. The same piece of information can be PII in one context and not in another. A person's name on a public patent application is not sensitive. The same name in a document that also includes their medical condition and home address creates a combination that is unambiguously sensitive. This context-dependence is one reason why PII removal is harder than it appears.

Legal frameworks slice this problem in different ways. GDPR defines personal data broadly as any information relating to an identified or identifiable natural person, where "identifiable" includes someone who can be identified by reference to an identifier like a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural, or social identity. CCPA takes a similar approach, defining personal information as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household. Both frameworks are deliberately expansive because the goal is to protect privacy in the real world, where re-identification attacks can combine apparently innocuous fields.

For the practical purposes of training data processing, most practitioners organize PII into four main categories.

The most commonly targeted categories in NLP training pipelines include:

• Direct identifiers: Information that uniquely identifies a person on its own, including full names, email addresses, phone numbers, Social Security numbers, national ID numbers, passport numbers, credit card numbers, and bank account numbers.
• Quasi-identifiers: Information that identifies a person only when combined with other attributes, such as zip codes, birth dates, job titles, employer names, and IP addresses.
• Sensitive categories: Information that, while not always identifying, carries heightened privacy risk, including health conditions, biometric data, religious beliefs, political opinions, sexual orientation, and immigration status.
• Location data: Home addresses, GPS coordinates, and named places associated with a specific individual.

The distinction between direct and quasi-identifiers matters for choosing detection strategies. Direct identifiers follow predictable patterns and respond well to regex or rule-based detection. Quasi-identifiers require context: a zip code in a census table poses no privacy risk, while the same zip code in a sentence like "the patient from 94102 was admitted on..." links to a specific person when combined with the other details.

The k-anonymity framework from the privacy literature formalizes quasi-identifier risk: a dataset satisfies k-anonymity if every combination of quasi-identifier values appears in at least k records. Below this threshold, individual records can be isolated and the corresponding person identified. This framework is useful for thinking about corpus-level risk even when you cannot compute exact k-anonymity for a web crawl.

In practice, most PII removal pipelines focus on direct identifiers because they are both the most automatable and the highest-risk. Names are the notable exception: they are technically direct identifiers but they are also extremely common in legitimate text and extremely difficult to remove without destroying the document's usefulness. A chapter about the signing of the Declaration of Independence cannot remain useful if every person name is redacted.