Personally Identifiable Information (PII)

PII is any data that can identify a specific person — name, email, phone number, address, IP address, government IDs, or combinations that together single someone out. It's the category regulators care most about: GDPR, CCPA, and similar laws impose obligations on how you collect, store, and delete it. For SaaS builders, knowing exactly what PII flows through your system is the foundation of privacy compliance and a recurring question on every data-processing agreement. It matters even more with AI features: sending customer PII to an LLM provider means that data leaves your boundary, so you need the right data-processing terms and often a way to redact or avoid it. Practical note: minimize what you collect, encrypt sensitive fields, and be able to find and delete a given person's data on request (the "right to erasure"). Tag PII fields in your schema early — retrofitting a data map across a mature codebase is painful.