PII (Personally Identifiable Information)
Any data usable to identify a specific person — including names, IDs, and biometric data.
Related terms
Confidential Data
The broader category that PII and PHI both sit inside — anything an organization has a legal, contractual, or competitive obligation to keep from being disclosed, which makes it the thing AI risk controls ultimately exist to protect, whatever specific name the data happens to carry.
Payment Records
Transaction data — card numbers, bank account details, billing information, and purchase history — that is both commercially sensitive and subject to specific industry security standards, making it a distinct category of data to protect before it reaches an external AI model.
Payroll Data
Compensation and employment records — salaries, tax details, bank deposit information, benefits elections — that combine personal identity with some of an employee's most sensitive financial information, and that carries obligations to employees as well as to regulators once it's sent to an external system.
PHI (Protected Health Information)
Health information tied to a specific, identifiable individual — the legally defined category under HIPAA that determines whether health-related data can be shared freely or requires specific safeguards, including when it's sent to an external AI tool.
Privacy by Design
The principle that privacy protections should be built into a system's architecture from the start, rather than added afterward — a standard that shapes how regulators expect AI adoption to be evaluated, not just how a finished system happens to behave.
Privacy Engine
The underlying software component that actually detects and protects sensitive data — the part of a data protection system that does the technical work of finding identifiers and deciding what to do with them, as distinct from the policies, dashboards, or deployment model built around it.
See PII (Personally Identifiable Information) in practice
Questa AI anonymizes sensitive data before it reaches any AI model — across documents and live prompts, with governance and data-residency control.