PII (Personally Identifiable Information)

Data

About 1 min read

Refers to information that can identify a specific individual on its own or in combination with other details, such as names, resident registration numbers, and contact details. It is a critical management subject for preventing data leakage and ensuring legal compliance during AI adoption.

Also known as

Personally Identifiable InformationPersonal Information

Detailed explanation

PII encompasses any information that can uniquely identify or trace an individual, serving as the foundation of global regulations such as the Personal Information Protection Act (PIPA) in South Korea and the General Data Protection Regulation (GDPR) in Europe. In generative AI environments, there is a risk of 'data privacy infringement' where sensitive information entered into prompts by users is reused for model training or exposed in other users' responses. Therefore, when adopting enterprise AI tools, it is crucial to verify the automatic detection and de-identification (masking) of PII in input data, the location of data storage, and the service provider's data usage policies (such as supporting opt-outs). Especially since recent regulations like the EU AI Act strengthen the privacy responsibilities of AI systems, using tools without proper technical safeguards can severely impact a company's credibility and lead to legal fines.

Why it matters in tool selection

Because public AI models may use inputs for training, once data containing internal PII is leaked externally, it cannot be retrieved. This directly leads to violations of GDPR and the local PIPA, making it essential to select tools where data rights belong to the user and settings to exclude training are available.

What to check

Whether input data is utilized for model retraining and if an opt-out (training exclusion) feature is provided
Whether real-time detection of PII within prompts and automatic de-identification (anonymization) technology are applied
The location of data storage and processing (sovereignty) and possession of security certifications like SOC 2 and ISO 27001

Example

When using AI to summarize customer service histories, a representative example of a PII protection measure is automatically replacing the customer's real name and phone number with '***' or 'CUSTOMER_NAME' before transmitting it to the model.

References

All glossary terms