Personally identifiable information (PII)
Personally identifiable information (PII) is data that identifies a specific person directly or can reasonably be linked with other information to identify that person.
Direct identifiers include information such as a name, phone number, email address, or government-issued identifier. Indirect identifiers can become identifying when combined, such as a precise location, workplace, appointment time, account history, or a distinctive set of demographic details. Context matters: a value that looks anonymous in one table may identify someone after it is joined with another dataset.
PII is a widely used term, but its precise scope varies across laws, regulations, contracts, and organizational policies. The GDPR generally uses the broader term personal data. HIPAA uses protected health information for identifiable health information held or transmitted in a covered context. Teams should map the definitions that apply to their organization rather than treating the labels as interchangeable.
PII in an AI phone call
Phone calls can contain PII in both obvious and less visible forms. The caller may state a name, address, account number, or date of birth. The system may also create a recording, transcript, summary, call identifier, phone-number record, extracted field, or tool request that can be linked back to the caller. A voice recording can itself be identifying, especially when it is stored with call metadata.
Managing PII starts with purpose and minimization. The agent should ask only for information needed to complete the approved task. Sensitive values should not be repeated aloud unless necessary, inserted into free-form summaries by default, or sent to an integration that does not need them. Human handoffs need the same review because screen pops, call notes, and transfer briefings can expose data beyond the automated portion of the call.
Protect the full data lifecycle
A useful inventory records where each data element is collected, processed, transmitted, stored, viewed, and deleted. Access controls and retention rules should cover derived artifacts as well as raw audio. Redaction can reduce exposure, but it should be tested across recordings, transcripts, summaries, logs, and downstream destinations rather than assumed to work everywhere.
PII handling is not a one-time classification exercise. When a prompt, integration, or call purpose changes, the organization should reassess what is collected and which privacy obligations follow.