PII vs personal information vs personal data: how US and EU terms differ

Which term should you use: PII, personal information, personal data or PHI?

Use the term that belongs to the law you are talking about. PII is a common security shorthand with no single US legal definition, "personal information" is the CCPA's term, "personal data" is the GDPR's term, and PHI is HIPAA's term for health information held by covered entities and business associates. They overlap but are not interchangeable.

For a referral partner the practical rule is simple: avoid saying "it has no PII" to an owner. Say which framework you mean, and leave the legal conclusion to the company's counsel. Wrong labels create false comfort, and false comfort kills deals later in rights review.

Side-by-side: the four terms

Read the primary text before relying on a summary: the California Consumer Privacy Act statute holds the CCPA definitions, the GDPR text holds Article 4, and HHS explains PHI in its de-identification guidance.

How do the definitions differ in practice?

The differences that matter for business records are these.

1. Who is protected. The CCPA speaks of consumers, a term California defines as California residents, which includes employees and business contacts. HIPAA protects patients and plan members only within covered contexts. The GDPR protects people in the EU or whose data is processed in scope.
2. What counts as identifiable. PII lists often name direct identifiers such as a Social Security number. The CCPA and GDPR also reach information that can be linked to a person indirectly, such as a device ID or a role plus an employer.
3. What happens after de-identification. Each regime has its own test for when information stops being covered, so removing a name column may satisfy one and not another.
4. Who is on the hook. HIPAA obligations attach to specific entities. The CCPA applies to businesses meeting its thresholds, which the California Privacy Protection Agency FAQ lists; the GDPR can reach non-EU organizations in some situations.

Workplace examples: which label fits?

Rows marked "if in scope" depend on where the people are and where the company operates. The employment and B2B angles for California are covered in the CCPA B2B exemption guide and the workforce question in do you need employee consent to license workplace data.

When each term wins

• Use PII in casual conversation with a security-minded owner, then ask what their policies or contracts define as PII.
• Use personal information when the company has California employees, customers or contacts.
• Use personal data if the records include people in the EU; see whether the EU AI Act applies to a US company for the adjacent regulatory question.
• Use PHI only when the company is a covered entity or business associate, or handles health plan or provider data.

Common vocabulary mistakes with owners

Questions to ask the owner

• Which states and countries are the employees, customers and contacts in?
• Does any system hold health, financial or children's information?
• Who at the company, or its outside counsel, owns privacy questions?
• Have customer contracts or employee notices said anything about reuse of records?

Those four answers let counsel pick the right framework quickly, and they keep the partner conversation factual rather than legal.

How SourceX fits

You do not need to label a prospect's data to refer it. Classification happens later, when the company inventories its systems with SourceX and rights are reviewed, with redaction requirements settled before any work begins. Strong prospects often have large operational datasets that do not depend on customer personal information; see can a company qualify without sharing customer personal information.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting on any definition.

Next step

Screen a prospect with the company fit checker, a preliminary non-binding screen that needs no contact details, and review how it works. Then register as a partner to make the introduction.