What it means
In business, protecting Personally Identifiable Information is a legal and ethical duty. Whenever you collect customer names, employee records, payment details, or email addresses, you are handling PII.
Laws such as the General Data Protection Regulation make organisations strictly accountable for how they gather, store, and use this sensitive data. If a company fails to protect it, the consequences can include severe financial penalties and permanent damage to customer trust.
From an accounting and finance perspective, PII is deeply embedded in everyday operations. Payroll systems hold national insurance numbers and salary figures.
Invoices often contain home addresses and personal phone numbers. Customer relationship management tools track purchase histories linked to individual buyers.
Because finance teams handle so much of this sensitive data, they must work closely with IT departments to ensure systems are secure and access is restricted only to authorised personnel. Managing PII effectively involves collecting only what is strictly necessary for business purposes, keeping it secure through encryption or password protection, and deleting it securely when it is no longer needed.
Treating customer and employee data with respect prevents costly security breaches and builds a reputation for reliability. Non-finance managers must understand that data protection is not just an IT problem, but a core operational responsibility for every department.
PII is like a set of house keys entrusted to your business. You would not leave them sitting on the front doorstep for anyone to take, so you must treat customer data with the same level of care and secure storage.
In practice
Real-world examples
Example 1
A freelance designer collects client home addresses and phone numbers on invoices. Under data rules, this is PII and must be stored securely, not left in an unattended folder on a shared desk. She also decides to delete old invoices from her email once the legal retention period has passed. When a client emails to ask what data she holds, she can produce a clear answer within days, which keeps her compliant and her reputation intact.
Example 2
A local retail shop runs a customer loyalty programme, storing email addresses and purchase habits. This is PII and requires a clear privacy policy and a secure database. The owner limits access to two staff members and removes customers who ask to be forgotten. The shop also stops collecting dates of birth, because it never uses them for anything, which reduces both the risk and the paperwork.
Example 3
A growing software company processes employee bank details for payroll. This financial and personal data is high-risk PII that demands strict access controls. Only the payroll manager can view the full account numbers, and every export is logged. If a spreadsheet ever needs to go to the external accountant, it is password protected and the password is sent separately.
Think of it
PII is like a set of house keys entrusted to your business. You would not leave them sitting on the front doorstep for anyone to take, so you must treat customer data with the same level of care and secure storage.
Case study
Seen in the real world
This is a fictional, illustrative scenario. Brighton Bakery, a regional catering firm with twenty staff, decided to launch an online ordering platform to boost sales. During the project, the founders collected customer names, delivery addresses, and credit card details without setting up proper encryption on their website. Six months later, a cyber security audit revealed a vulnerability, exposing the personal details of 1,000 customers.
The data protection regulator investigated the lapse and issued a fine of $15,000. Beyond the fine, Brighton Bakery suffered negative local press, leading to a 20% drop in online orders over the following quarter. To recover, the company invested in secure payment gateways, trained all staff on data privacy, and purged old customer records. The total cost of the breach far exceeded what it would have taken to implement proper security measures from the start.
The costs can be added up. If online orders normally brought in $30,000 a quarter, a 20% drop meant $6,000 of lost sales. Add the $15,000 fine and about $9,000 for new payment security and staff training, and the incident cost roughly $30,000 in total, while a properly secured website at the start would have cost a fraction of that.
Watch out
Common mistakes
- Assuming PII only includes government ID numbers, forgetting that email addresses and IP data also count.
- Storing sensitive customer records on personal laptops or unencrypted spreadsheets.
- Keeping old employee or customer data indefinitely rather than deleting it when no longer needed.
Questions
People also ask
What data counts as PII?
Anything that can identify a specific person, either directly like a name or passport number, or indirectly like a device identifier or postcode combined with other facts.
Do small businesses have to follow PII laws?
Yes, data protection laws apply to businesses of all sizes, from sole traders to large corporations, whenever they handle personal data.
How long should a business keep PII?
You should only keep personal data for as long as you have a clear business or legal reason to retain it, such as tax rules requiring invoice storage.