PII (Personally Identifiable Information)

Personally Identifiable Information is data that can be used alone or combined with other information to identify, contact, or locate a specific individual, subject to privacy protection requirements under regulations including GDPR, CCPA, and sector-specific data protection laws.

PII includes direct identifiers such as names, email addresses, phone numbers, government ID numbers, biometric data, and financial account information, as well as quasi-identifiers like IP addresses, device IDs, geolocation data, and behavioral patterns that can identify individuals when combined. Under GDPR, PII is termed "personal data" with broad interpretation encompassing any data relating to an identified or identifiable natural person.

In crypto and blockchain contexts, determining what constitutes PII is complex. Cryptocurrency wallet addresses are pseudonymous rather than anonymous, and blockchain analytics can link addresses to real identities through exchange KYC data, IP addresses during transaction broadcasts, or on-chain behavioral patterns. When wallet addresses can be attributed to specific individuals, they may constitute PII triggering GDPR obligations. VASPs collecting KYC information, transaction histories, and wallet addresses must implement data protection controls, encryption, access restrictions, and retention limits. Zero-knowledge proof systems and privacy-enhancing technologies enable verification of attributes without exposing underlying PII, addressing compliance requirements while preserving individual privacy.