PII (Personally Identifiable Information): Any information that can identify a specific individual, either directly (name, phone number, ID number) or indirectly when combined with other data (location, job title, photos).
Also known as: Personally identifiable information, Personal data (GDPR term), Datos personales
Key takeaways
- PII includes direct identifiers (name, phone, ID) and indirect ones that identify someone when combined.
- Work chat collects PII constantly: phone numbers, photos, locations, addresses and client details.
- Privacy laws use slightly different terms, such as personal data under GDPR, and often broader definitions.
- C Chat hashes phone numbers with SHA-256 on the device for contact matching, and the server does not store the hashes.
- Usernames let people chat without sharing a phone number; direct messages are private.
Look at any busy work group and count the personal details: a client’s address, a technician’s phone number, a photo of a visitor’s badge, a live location shared during a callout. None of it is unusual, and all of it is PII. Knowing what counts and where it flows is the first step to handling it responsibly.
PII (personally identifiable information): a plain definition
PII is information that points to a specific person. Privacy professionals usually split it into two groups:
| Type | Examples |
|---|---|
| Direct identifiers | Full name, phone number, email address, ID or passport number, face photo |
| Indirect identifiers | Date of birth, home address, job title, workplace, precise location, device identifiers |
Indirect identifiers may not identify anyone alone, but combined they often do. “Night supervisor at the north warehouse” may describe exactly one person.
Some PII is especially sensitive: health information, financial account numbers, government IDs. Those deserve stricter rules about where they can be shared.
How it works
PII enters a messaging system through several routes:
- Account data: name, phone number or email, profile photo.
- Contact discovery: the address book used to find colleagues.
- Message content: text, photos, files and voice notes that mention or show people.
- Location sharing: a pin dropped in a group.
- Metadata: who talked to whom and when. See metadata in messaging.
Each route has its own risks. Contact discovery is a classic one: some apps upload whole address books in plain form. Location data is another, covered in location sharing at work: privacy rules.
Why it matters for business messaging
When PII flows through personal apps, the company loses control of it. A former employee still holds client phone numbers; a personal group with suppliers contains photos of staff IDs. The guide on the risks of using personal WhatsApp for work covers these scenarios in detail.
Privacy laws also raise the stakes. In Europe, GDPR sets rules on processing personal data; several Latin American countries have their own data protection laws, summarized in data protection in Latin America: chat basics. Where that data is stored is a separate question, covered under data residency.
How it relates to C Chat
Here is what C Chat collects and how it limits who sees it:
- Sign-up uses a phone number (SMS code) or an email (email code), plus a name and an optional photo.
- @usernames let people start conversations without exchanging phone numbers.
- Contact matching hashes phone numbers with SHA-256 on the device before matching, and the server does not store the hashes. Details are in how contact matching protects phone numbers.
- Encryption: TLS in transit and AES-256 at rest with a key per organization.
- Visibility: team owners and admins can audit and export group conversations; direct messages between people stay private. The page who can read my messages in C Chat lays this out, and why direct messages stay private explains the reasoning.
When someone wants their data removed, they can request it through account deletion.
Related terms and common misconceptions
- “Hashed data is anonymous.” Not always. Hashing protects values in transit and comparison, but short inputs like phone numbers can sometimes be guessed. Minimizing storage, as C Chat does by not keeping the hashes, matters as much as the hash.
- “Only names and IDs count.” Photos, locations and job details can identify people too.
- “Encryption makes PII handling irrelevant.” Encryption protects stored data from outsiders; it does not decide who inside the company should see it.
Getting started
Write down which personal details your team may share in chat, then move that work into groups the company controls. Sign up in the web app at getcchat.com/c with your phone number or email, set an @username and invite your team.
Frequently asked questions
What are examples of PII?
Direct examples include full name, phone number, personal email, government ID number and a clear photo of a face. Indirect examples include a home address, date of birth, job title at a small company or precise location history, which can identify someone when combined.
Is PII the same as personal data under GDPR?
They overlap but are not identical. PII is a term used mainly in US practice. GDPR uses personal data, defined broadly as any information relating to an identified or identifiable person, which can include online identifiers and location data.
Is a phone number PII?
Yes. A phone number is typically linked to one person and can be used to identify or contact them. That is why C Chat hashes numbers on the device during contact matching and does not store those hashes on the server.
Can employees share PII in a work chat?
Often they need to, for example a client's address for a service visit. A messaging policy should say what kind of PII may be shared, in which groups, and what must never be posted, such as full ID or card numbers.
Who can see the PII in C Chat conversations?
Members of a group see that group's messages, and team owners and admins can audit and export group conversations. Direct messages between people are private. The platform only accesses content for moderation of reported messages or legal requirements, and that access is logged.