SECAI Core · phase 4 of 15
Personally identifiable information
Data that can be used to identify or contact an individual (or, in the case of identity theft, to impersonate them).
The Explain card
- Plain English
- PII is any data that can single out, contact, or impersonate a specific person: names, addresses, ID numbers, biometrics, even birthday plus postcode.
- Example
- A customer support chatbot is fine-tuned on real ticket histories. Later, a tester asks for "an example of a refund request" and it replies with a real customer's name, phone number and address, lifted from the training data.
- Why it matters
- PII that leaks through a model output or a prompt log is a breach, with all the regulatory and reputational cost that implies. Defenders must track where PII enters training sets, prompts, embeddings and logs.
- Hook
- If it can point to a person, it is PII, and it has a way of resurfacing in model output.
Where it sits in the deck
Phase 4: Data Integrity, Governance, and Provenance
Once you know what data is, learn the principles that keep it trustworthy, traceable, and minimized throughout its lifecycle.
