PII at Work: Examples, Where It Hides, and How to Protect It
A support ticket lands in the queue. It carries a customer’s name, phone number, and order history, plus a screenshot of the account page. The agent answers it, tags it, and passes it to billing. Ten minutes, three hands, and a handful of new places that data now lives.
Nothing about that was careless. It’s what ordinary work looks like, and it’s why personally identifiable information (PII) isn’t a topic only legal and compliance teams think about. PII sits in the tools your people use all day, in the details they’re trusted to handle, and in small decisions about where to send it next.
In IBM’s 2026 Cost of a Data Breach Report, customer PII was the most commonly stolen or compromised data type, involved in 52% of the breaches studied, and employee PII in 35%.
This guide is for the people who explain that to everyone else. It covers examples of PII at work, where it hides, how attackers put it to use, and the habits and support that help teams protect it.
This article is general information, not legal advice. Laws and definitions change, so confirm what applies to your organization with qualified counsel.
What counts as PII in the workplace?
The National Institute of Standards and Technology‘s (NIST) Special Publication 800-122 defines PII as information that can be used to distinguish or trace a person’s identity, such as a name, Social Security number, or biometric record, along with any other information linked or linkable to that person, such as medical, educational, financial, and employment information.
In plain terms: If the information can point to a specific person, alone or combined with other details, handle it with care.
NIST’s guide, written for federal agencies, uses that definition, and the rules that apply to your organization may define personal information differently. For how definitions and obligations vary by rule, see our guide to PII Training Requirements: What the Rules Say and What Auditors Ask For.
Examples of PII at work, by type
These personally identifiable information examples fall into three layers. Knowing which layer you’re dealing with helps you decide how carefully to handle it.
Direct identifiers. These point to one person on their own: A full name, Social Security number, driver’s license or passport number, date and place of birth, home address, personal phone number, and biometric records such as fingerprints.
Linked data. These may not identify anyone alone, but they attach to a person: Job title and employment history, salary, performance notes, account history, order history, benefits and medical information, and education records.
Online identifiers. These trace a person across systems: Email addresses, usernames, IP addresses, device IDs, and cookie identifiers. Whether they count as PII depends on context and which rule applies, a point we come back to in the FAQ below.
Most real records mix all three. A customer file with a name, an order history, and an email address is a PII record, even if no single field would be on its own.
Where PII hides in everyday work
Where is PII stored in an organization? In more places than the system built to protect it. PII spreads to wherever work happens:
- Shared spreadsheets. A quick export for a project becomes a file with a long life and a wide share list.
- Email threads. Names, addresses, and attachments get forwarded, replied to, and archived.
- Support tickets and chat. Customers paste details, and agents paste them onward.
- HR and payroll files. Offer letters, tax forms, bank details, and performance notes live in more than one folder.
- Screenshots and recordings. A screen share or a recorded meeting can capture a full record.
- Exports and test data. Copies of production data used for testing or reports often outlive the task.
- AI tools. Pasting customer or employee details into a tool your organization hasn’t approved can send that data outside its controls.
You can’t protect what you can’t find, so the first habit is simple: Know where PII sits.
How attackers use the details your team shares
Attackers don’t usually start with the phone call. They start with research. Names, job titles, reporting lines, and routines on public profiles help them sound like someone who belongs in your network, and that makes a request feel ordinary.
NINJIO Founder Zack Schuler made the same point in Dark Reading: Organizations need people to be “mindful of their digital behavior in other domains,” not just careful with passwords and links.
The 2023 cyberattack on MGM Resorts shows the pattern. In September 2023, MGM disclosed a “cybersecurity issue,” and Forbes reported that guests waited hours to check in while electronic payments, digital key cards, slot machines, and ATMs were disrupted.
According to the attackers’ own account, relayed by malware research group VX-Underground, the ALPHV/BlackCat ransomware group:
- Researched first. It used social engineering to identify an MGM IT support employee on LinkedIn.
- Then called. The next step was a call to the MGM help desk, which took about 10 minutes.
Those details come from the malware research group’s claim. When Forbes reported on it, neither MGM nor the FBI had publicly characterized the breach, and ALPHV’s responsibility hadn’t been verified. Experts Forbes spoke with called VX-Underground a reliable source.
Look at what the attackers reportedly needed: A name and a job role. Employment information falls within NIST’s definition of PII when it’s linked to a person, and in this account, it sat on a public profile. NIST treats information that’s readily obtainable, such as through an internet search engine, as linkable to a person.
Where NINJIO fits. NINJIO’s episode, “All Bets Are Off” is based on the attack and shows how vishing, a convincing phone call instead of an email, works on its targets.
The lesson isn’t that anyone should hide a professional profile, and it isn’t about the person on the other end of the call. A help desk is a team of defenders doing its job, and a convincing request can sound ordinary.
The safeguard is a process that doesn’t depend on how credible a caller sounds: Ask for something an online profile can’t supply, confirm through a number or tool you already trust, and give your help desk and finance teams an agreed way to do it.
How can I protect my PII data at work?
Here’s how to protect PII at work without turning every task into a project. These PII best practices for employees work best when the whole team shares them, and managers make them easy to follow.
- Know what you hold. List the PII your team touches and where it lives. A 30-minute map beats a guess.
- Share the minimum. Send the fields someone needs, not the whole record, and mask the rest.
- Verify requests through a separate channel. If someone asks for personal data, a payment change, or an account reset, confirm through a number or tool you already trust, not the one in the request.
- Use approved tools. Keep PII in the systems your organization has approved, and out of personal email, unapproved apps, and AI tools no one has reviewed.
- Limit access. People should see the data their role needs, and access should change when roles do.
- Report mistakes without blame. A misdirected email or a wrongly shared file is easier to contain when the person who spots it speaks up fast. Make it easy for them to report.
- Dispose of data securely. Delete exports and test copies when the task ends, and follow your retention policy for the rest.
Password managers and multifactor authentication (MFA) belong on the list as account protection. They guard the doors to the systems that hold PII. Use a password manager for unique passwords, and turn on MFA wherever it’s offered.
What your organization can provide
Employees shouldn’t carry this alone. Protecting personally identifiable information gets easier when the organization makes the safe way the easy way, and PII data handling improves when people have these four things:
- A clear, short policy that says what counts as PII, where it can live, and who to ask.
- Approved tools that fit how people actually work, including guidance on AI tools.
- Short, recurring training that keeps good habits fresh without pulling people away from their day.
- An easy way to report a mistake or a suspicious request, with no blame attached.
Where NINJIO fits. NINJIO AWARE delivers short, story-driven episodes built on real attacks, so people see how a convincing request plays out.
Three actions for this month
- Map one workflow. Pick a task where PII moves, such as support tickets or onboarding, and write down every place the data lands. Thirty minutes with the people who do the work is enough.
- Agree on the verified path. Choose how staff confirm requests that involve personal data or account changes, and share it with managers and the help desk on one page.
- Make reporting easy. Tell people where to report a mistake or a suspicious request, and say out loud that speed matters more than perfection.
The habits above stick when training, practice, and follow-up keep pace with real work.
Where NINJIO fits. ALERT gives employees a one-click way to report a suspicious email from inside their inbox.
Protecting PII at work is a team habit
The habits above stick when training keeps pace with real work. Give your team the privacy basics, in short episodes. Watch a trailer on data privacy, identity theft, MFA, or stolen credentials, or get three free episodes to share with your team.
Frequently Asked Questions
Any information that identifies a person or can be linked to one: Names, ID numbers, contact details, financial details, employment records, and online identifiers for customers, employees, candidates, and partners. Definitions vary by rule, so check the one that applies to you.
Often, depending on context. NIST’s guide lists email addresses among examples of information that may be considered PII, and an address that names a specific person, such as [email protected], is the clearest case. Some laws protect an email address only in combination with other data. California’s breach notification law, for example, covers a username or email address together with a password or security question and answer that would permit access to an online account.
Usually not by itself. Standard definitions treat PII as information about a person, and a password is a secret that protects access. It still deserves the highest care. Passwords guard the accounts that hold PII, and some laws treat credentials as protected personal information when paired with a username or email address, as California’s does. Always treat passwords as sensitive.
In more places than the official system: Shared spreadsheets, email threads, support tickets and chat, HR and payroll files, screenshots and meeting recordings, exports and test data, and AI tools. Start by mapping one workflow, as in the three actions above.
You’ll find it at ninjio.com/privacy-policy. It explains how NINJIO uses personal information collected through its website.
