Personally Identifiable Information (PII)
Written by Justin Goodman, CIC, CISC, CLCS, CEO and Co-Founder, Total CSR
Published: October 5, 2026 · Last reviewed: October 5, 2026
In plain language: Personally Identifiable Information is any detail that can identify a specific person, like a Social Security number, driver's license number, or credit card data. Insurance policies care about PII because losing it, leaking it, or mishandling it creates real financial harm and legal liability.
Technical definition: Personally Identifiable Information refers to data elements that, alone or combined, can identify, locate, or contact a specific individual. Cyber liability, privacy liability, and technology E&O policies define covered PII explicitly in their declarations and definitions sections, and that definition controls what triggers breach response, notification, and defense coverage.
Personally Identifiable Information (PII) at a Glance
| Attribute | Detail |
|---|---|
| Also known as | Personal Information, PI, Sensitive Personal Information, Personal Data |
| Category | Cyber liability and privacy coverage concept |
| Lines of business | Cyber Liability, Commercial General Liability, Technology E&O, BOP |
| Industries most affected | Healthcare, retail, financial services, professional services, hospitality |
| Related forms or endorsements | ISO CG 21 06 (exclusion of access or disclosure), ISO CG 04 37 (cyber incident exclusion) |
| Who bears the risk | The business that collects, stores, or processes the data, and ultimately the affected individuals |
| Common solution | Standalone cyber liability policy with breach response, notification, and regulatory defense coverage |
| Also interacts with | Technology E&O, employment practices liability, directors and officers liability |
Key Takeaways
- Personally Identifiable Information is data that can identify a specific person, such as a name paired with a Social Security number, account number, or health record.
- Agencies need to understand PII because most CGL and BOP policies exclude or sharply limit coverage for its loss, making a standalone cyber policy the real risk transfer tool.
- The most common pitfall is assuming general liability or a package policy's small data breach sublimit will respond to a real incident, when most CGL forms now carry explicit exclusions for personal information exposure.
- A quick win for agencies is asking every commercial client what categories of PII they collect, store, or transmit before quoting, since that answer drives both the cyber application and the limit conversation.
What Is Personally Identifiable Information (PII) in Insurance?
Personally Identifiable Information is the category of data that insurance carriers treat as uniquely dangerous to lose, because its exposure creates direct, quantifiable harm to real people. Carriers built cyber liability coverage specifically around this concept after state data breach notification laws proliferated in the 2000s, starting with California's SB 1386. Once nearly every state required businesses to notify individuals when their PII was compromised, the financial exposure shifted from theoretical to immediate and expensive.
PII typically includes Social Security numbers, driver's license numbers, financial account numbers, biometric data, and login credentials paired with a name. A name alone, with no other identifier, usually does not qualify. The legal doctrine behind this coverage centers on negligence and statutory duty: most states impose a duty to safeguard PII and a duty to notify affected individuals promptly after a breach, and failure to do either opens the business to regulatory fines and civil suits.
Consider a dental practice that stores patient names, birth dates, insurance ID numbers, and payment card information on an office server. A ransomware attack encrypts that server and the attacker threatens to publish the data. Every record on that server containing PII now triggers notification obligations under state law, and the practice faces forensic investigation costs, legal fees, notification letters, credit monitoring offers, and potential regulatory scrutiny, all before a single lawsuit is filed.
How Does Personally Identifiable Information (PII) Exposure Work?
- The collection. A business gathers PII from customers, employees, or patients, often through online forms, point-of-sale systems, or intake paperwork, creating a data asset the business is now responsible for protecting.
- The storage or transmission failure. A server gets breached, an employee laptop is stolen, or an email containing unencrypted records is sent to the wrong recipient.
- The discovery. The business identifies the incident, often weeks after it occurred, through a forensic IT review, a ransom demand, or a customer complaint.
- The notification trigger. State breach notification statutes require the business to notify affected individuals, and sometimes state attorneys general or the media, within a defined window once PII exposure is confirmed.
- The claim. Notification costs, credit monitoring, regulatory defense, and third-party lawsuits all get submitted to the cyber liability carrier, which investigates whether the compromised data actually met the policy's PII definition before paying.
Real Claim Examples Involving Personally Identifiable Information (PII)
Law firm email misdirection
A paralegal at a small law firm attached a client list containing Social Security numbers to an email and sent it to the wrong distribution group inside the firm's own domain. Even though the data stayed internal, several recipients were vendors with network access outside the firm's control, and the firm's cyber policy treated this as a reportable PII exposure under its definitions. The policy covered forensic review, legal guidance on notification obligations, and letters to the twelve affected clients, totaling under $15,000.
Retail point-of-sale breach
A regional clothing retailer's point-of-sale system was compromised by malware that skimmed credit card numbers and cardholder names from roughly 40,000 transactions. The retailer's cyber policy covered forensic investigation, PCI DSS assessment costs, notification to all affected customers, and a class action defense that followed six months later. The retailer's CGL policy, which carried an ISO CG 21 06 exclusion for personal information disclosure, would have denied this claim entirely had cyber coverage not been in place.
Healthcare clinic lost laptop
A physical therapy clinic's front desk laptop, containing unencrypted patient names, dates of birth, and insurance policy numbers, was stolen from an employee's car. Because the data included health-related identifiers, the incident triggered HIPAA breach notification rules in addition to the state's general PII statute, and the cyber policy's regulatory defense coverage paid for counsel representing the clinic before the Department of Health and Human Services Office for Civil Rights.
Personally Identifiable Information (PII) vs. Protected Health Information (PHI): What Is the Difference?
Personally Identifiable Information and Protected Health Information both describe sensitive data categories, but PHI is a narrower, HIPAA-specific subset that applies only to health-related data handled by covered entities and their business associates. Understanding which category applies determines whether HIPAA's stricter notification timelines and penalty structure apply in addition to general state breach law.
| Comparison area | Personally Identifiable Information (PII) | Protected Health Information (PHI) |
|---|---|---|
| Primary use case | General data privacy and breach notification across all industries | Health data privacy specifically under HIPAA |
| Coverage / concept type | Broad cyber liability trigger definition | Specialized subset requiring HIPAA-compliant handling |
| Typical exclusions | Publicly available information, aggregated anonymized data | Data not tied to treatment, payment, or healthcare operations |
| Who is most affected by errors | Any business collecting customer or employee data | Healthcare providers, insurers, and their business associates |
| Common mistakes | Treating a name alone as PII when no other identifier is attached | Assuming a general cyber policy satisfies HIPAA business associate agreement requirements |
What Are the Most Common Mistakes With Personally Identifiable Information (PII)?
- Agencies assume a BOP's small data breach sublimit, often $25,000 or less, will cover a real incident, when actual notification and forensic costs for even a modest breach routinely exceed six figures.
- Clients underestimate what counts as PII, excluding employee data, vendor records, or biometric timeclock information from their risk assessment and leaving gaps in their cyber application.
- CSRs fail to confirm whether a client's cyber policy defines PII consistently with the client's actual data holdings, missing categories like IP addresses or geolocation data that some state statutes now include.
- Producers quote cyber coverage without asking whether the client stores PII with a third-party vendor, which can shift liability analysis and require contractual risk transfer language in vendor agreements.
- Agencies treat CGL personal and advertising injury coverage as a backstop for PII exposure, ignoring that most current CGL forms carry explicit data breach or personal information exclusions like ISO CG 21 06.
How to Explain Personally Identifiable Information (PII) to a Client
Explaining PII to a personal lines client
Personally Identifiable Information means details like your Social Security number, driver's license number, or bank account information. If a company you've given that information to gets hacked, that breach involves your PII, and it's a big part of why identity theft protection services and credit monitoring exist as add-ons to some personal policies.
Explaining PII to a small business owner
Personally Identifiable Information is any customer or employee data that can identify a specific person, things like names paired with Social Security numbers, credit card numbers, or health information. If that data gets stolen or exposed, most states require you to notify everyone affected, and that notification process alone can cost tens of thousands of dollars before any lawsuit shows up. Cyber liability insurance is built specifically to cover those costs, because your general liability policy almost certainly excludes them.
Explaining PII to a CFO or risk manager
Personally Identifiable Information exposure sits at the center of your cyber liability underwriting, since the carrier's definition of covered PII directly determines what triggers breach response, regulatory defense, and third-party liability coverage. I'd recommend we map every category of data your organization collects, including vendor and employee records, against the policy's actual PII definition rather than assuming alignment. That mapping exercise also strengthens your position if a regulator or plaintiff's attorney challenges your breach response timeline.
Frequently Asked Questions About Personally Identifiable Information (PII)
Does a name alone count as Personally Identifiable Information?
A name by itself typically does not qualify as PII under most state statutes and insurance policy definitions. PII generally requires a name combined with another identifier, such as a Social Security number, driver's license number, or financial account number. Some newer state privacy laws, like California's CCPA, use a broader definition that can include standalone identifiers like IP addresses.
Will general liability insurance cover a PII data breach?
Most current CGL policies exclude coverage for data breach and personal information exposure, often through an endorsement like ISO CG 21 06. A handful of older or unendorsed CGL forms may respond under personal and advertising injury coverage, but agencies should never rely on that outcome. A standalone cyber liability policy is the correct, intentional risk transfer tool for PII exposure.
What is the difference between PII and PHI for insurance purposes?
PII is the broad category covering any data identifying a specific person, while PHI is a narrower subset specific to health information regulated under HIPAA. A breach involving both triggers two separate compliance tracks, general state breach notification law for the PII and HIPAA breach notification rules for the PHI. Cyber policies typically cover both, but agencies should confirm the policy's regulatory defense coverage names HIPAA explicitly.
How much coverage does a small business need for PII exposure?
Coverage needs depend on the volume of records a business holds and the applicable state notification costs, which commonly run $3 to $10 per affected individual just for notification letters, before forensic and legal costs. A business holding 10,000 customer records with Social Security numbers faces materially different exposure than one holding 200 email addresses. Agencies should quote limits based on actual record counts gathered during the cyber application process, not a flat industry assumption.
Does encryption eliminate PII breach liability?
Encryption significantly reduces liability in most states, since many breach notification statutes include a safe harbor exemption for properly encrypted data that is lost or stolen. Several real claims above, including the stolen laptop scenario, would not have triggered notification requirements had the device been encrypted. Insurers increasingly ask about encryption practices directly on cyber applications and may price coverage accordingly.
Related Insurance Terms
- Cyber Liability Insurance: A standalone policy covering data breach response, notification costs, regulatory defense, and related liability, built specifically to respond when PII or similar sensitive data is compromised.
- Protected Health Information (PHI): A HIPAA-regulated subset of PII limited to health-related data, triggering additional federal notification and compliance obligations beyond general state PII statutes.
- Data Breach: The event, such as a hack, theft, or accidental disclosure, that exposes PII and activates both legal notification duties and cyber insurance coverage.
- Notification Costs Coverage: A specific cyber policy coverage part that pays for the letters, call centers, and credit monitoring services required after a PII breach is confirmed.
- Technology Errors and Omissions: A liability policy for technology companies that often overlaps with cyber liability when a vendor's product failure causes a client's PII to be exposed.
- Regulatory Defense and Fines Coverage: A cyber policy component paying legal defense costs and, where insurable, fines imposed by regulators after a PII-related breach investigation.
Sources and References
- Federal Trade Commission. Data Breach Response: A Guide for Business.
- Insurance Services Office (ISO) / Verisk. ISO Forms and Endorsements.
About the Author
Justin Goodman, CIC, CCIP, CISC, CLCS, CRIS, PCIA, QCLS, MFHR CEO and Co-Founder, Total CSR, Inc.
Justin Goodman is a third-generation insurance broker with over two decades in agency operations. He has trained more than 100,000 CSRs, account managers, and producers in commercial and personal lines coverage, from workers' compensation to construction risk. He was named 2024 Insurance Journal Agent of the Year and one of the nation's top five construction insurance experts by Risk & Insurance. He is the author of Retain, which applies cognitive science research on memory and knowledge transfer to insurance training, and speaks nationally on how agencies build durable technical expertise in their teams.