Any information related to an individual that could be used to directly or indirectly expose the identity of that individual. Nearly every website collects some information about its customers but not all of it is considered PII. Data such as zip code, gender, ethnicity isn’t technically considered PII but data like a person’s full name, social security number, passport number is. Merchants that collect PII must be confident that this data is protected from unauthorized access, and ideally, would encrypt this data. In some cases, regulations such as GDPR and CCPA require merchants to provide customers the ability to request that their PII be removed from that merchants data storage.
