Terms related to data · 3.2.11
personally identifiable information
personal data: information that can be tied to a natural person, either directly or through a link, or that can be linked to that person directly or indirectly
What this term settles
The term looks ordinary until two teams use it differently. The entry removes that room by naming the thing, its inputs and its limits in one sentence.
Who it binds
The clause does not instruct anyone. It settles what personally identifiable information means so that an instruction written elsewhere can be read the same way by both sides.
What to do in your practice
Use the entry as a test in the next review. Ask the owner to point at the artefact that shows personally identifiable information in this sense, then record the answer with a date.
Evidence an auditor or regulator asks for
- A controlled vocabulary entry for personally identifiable information with the citation 3.2.11, an owner and a review date.An auditor can check that the term is controlled rather than assumed.
- A data inventory field that records the entry for each dataset used in training or operation.Shows personally identifiable information in use in the artefact the firm relies on, not only in a glossary.
- A data quality record with the check, the date and the person who signed it off.The data inventory is organised by system rather than by dataset, so the same data is described twice with different labels.
Common gaps this page catches
- personally identifiable information is used in the data record behind every AI system without a written definition, so two teams can mean different things.
- A local synonym has grown up beside the entry and the two are now used interchangeably.
What to prepare before the amendment lands
Take the next policy revision and replace the loose use of personally identifiable information with the entry and its citation. Record the change in the vocabulary change log.
How to test it here
Take one live artefact rather than a template, find the sentence or field where personally identifiable information is used, and put this page beside it. Record the answer, the artefact and the date, because that record is the evidence and a glossary entry on its own is only an intention.
What this page does not claim
The page does not reproduce the standard, certify the firm or predict the wording the amendment will use; it states personally identifiable information at the claim level "definition" and stops where the public record stops.
Common questions
- What does personally identifiable information mean in ISO 22989?
- personal data: information that can be tied to a natural person, either directly or through a link, or that can be linked to that person directly or indirectly
- What evidence should we keep for 3.2.11?
- A controlled vocabulary entry for personally identifiable information with the citation 3.2.11, an owner and a review date. A data inventory field that records the entry for each dataset used in training or operation.
- Is personally identifiable information a requirement?
- No: personally identifiable information is a definition or clause of a terminology standard, and it becomes binding only when a firm writes it into a policy, a contract or a procedure, or when another standard incorporates it.
Related units
Source. ISO/IEC 22989:2022, Clause 3.2.11, Terms and definitions. Open the ISO public entry. Retrieved 21 October 2026.
https://www.iso.org/obp/ui/en/#iso:std:iso-iec:22989:ed-1:v1:en
ISO catalogue record 88145, the amendment status, stage and dates. Catalogue record 74296, the base standard.
Claim level: definition. The definition is in the public preview. This page states it in our own words and does not reproduce the text.
Last updated: 2026-10-21 · Markdown version · Check your vocabulary