Personally Identifiable Information (PII)
- What it is
- Any data that can identify a specific person on its own or in combination: name, address, email, phone, government ID, account numbers, biometrics, IP address in some jurisdictions.
- Why it drives architecture
- Regulations attach obligations to it — GDPR, HIPAA (as PHI), PCI DSS for card data, CCPA — covering where it may be stored, who may see it, and how long it is kept.
- Under the AWS shared responsibility model, classifying and protecting your PII is your side of the line. AWS secures the infrastructure; it does not know which of your objects contain PII.
- Services that deal with it
- Amazon Macie — discovers and classifies PII sitting in Amazon S3.
- Amazon Comprehend — detects and redacts PII entities inside free text.
- Encryption at rest (AWS Key Management Service (KMS)) and in transit, least-privilege IAM, and AWS CloudTrail for the audit trail.
- Exam signal
- “Sensitive data discovery in S3”, “find PII” → Macie. “Redact PII from documents or transcripts” → Comprehend.