Securing Records That Contain PII

Personally identifiable information (PII) is any data that can identify a specific individual on its own or in combination with other information. It ranges from obvious identifiers such as names, Social Security numbers, and biometric data to contextual elements that become identifying when linked together. Records containing PII sit at the intersection of two disciplines that are sometimes treated separately but must operate as one: records management, which governs how information is created, kept, and ultimately destroyed, and information security, which governs how that information is protected while it exists. Securing PII is not a single control bolted onto a system; it is a set of practices applied consistently across the entire records lifecycle.

The central principle is that protection must be proportional to sensitivity and must follow the record wherever it goes. A spreadsheet of customer addresses, a personnel file, an email thread containing health details, and a backup tape can all carry the same legal exposure if mishandled. Effective programs therefore treat PII protection as a property of the record itself, enforced by policy and technology, rather than something that depends on the goodwill or memory of individual staff. The sections below walk through the controls and governance practices that make that possible.

Identify and Classify PII Before Protecting It

You cannot secure what you have not located and labeled. The first discipline is inventory: knowing which record series, systems, repositories, and shared drives contain PII, and at what level of sensitivity. Many organizations distinguish between general PII and sensitive PII (for example, government identifiers, financial account numbers, and health or biometric data) because the latter warrants stronger safeguards and faster breach response. Classification should be tied to the record series in the retention schedule so that handling rules travel with the records over time.

Practical identification techniques include data mapping during system intake, automated discovery scanning of unstructured stores, and metadata tagging at the point of capture. In federal contexts, much PII held in systems of records is governed by the Privacy Act of 1974, which establishes requirements for how agencies collect, maintain, use, and disclose information about individuals. Classification work should reflect those legal obligations rather than treating all PII as interchangeable.

Apply Access Controls and the Principle of Least Privilege

Once PII is identified, the most consequential safeguard is limiting who can reach it. Access should be granted on a need-to-know basis and reviewed regularly, removing entitlements when roles change or staff depart. Role-based access control, strong authentication, and segregation of duties reduce both accidental exposure and insider misuse.

Key access practices include:

• Granting the minimum permissions necessary for a job function, and defaulting to no access.
• Logging and monitoring access to sensitive records so that unusual activity can be detected and investigated.
• Restricting bulk export, download, and printing of PII, which are common vectors for large-scale loss.
• Periodically recertifying access lists rather than letting permissions accumulate over years.

Auditability is part of access control, not an afterthought. Reliable, tamper-evident logs of who viewed, changed, or deleted a PII record support breach investigation, demonstrate compliance, and create accountability.

Protect PII at Rest and in Transit

Technical safeguards reduce the consequences of a control failure. Encryption of PII both at rest (in databases, file stores, and backups) and in transit (across networks and between systems) means that intercepted or stolen data is far less useful to an attacker. Encryption should be paired with disciplined key management, because poorly protected keys negate the benefit.

Other protective measures include network segmentation that isolates systems holding sensitive PII, secure configuration and patching of those systems, and data minimization at the source. Minimization is often overlooked but powerful: collecting only the PII genuinely needed, and masking, redacting, or de-identifying it where the full value is unnecessary, shrinks the attack surface permanently. A record that never contained an unneeded Social Security number cannot leak one.

Manage Retention and Secure Disposition

Holding PII longer than necessary multiplies risk and legal exposure. Sound records management treats timely, authorized disposition as a security control in its own right. Retention periods should be set by an approved schedule, and when records reach the end of their authorized life and are not under a legal hold, they should be destroyed in a documented, defensible manner.

Disposition of PII demands more than dragging files to a trash folder. Electronic media should be sanitized or destroyed so the data cannot be reconstructed, paper should be shredded, and backups and replicated copies must be addressed so that “deleted” records do not survive in secondary stores. The General Records Schedules and an organization’s own schedules provide the authority and timing for these actions; the records program supplies the proof that disposition was carried out as authorized.

Govern with Standards, Policy, and Accountability

Tools and tactics need a governance frame to stay consistent. Recognized standards help organizations design defensible controls and demonstrate due diligence. The NIST Privacy Framework offers a structured way to identify privacy risks and align safeguards with organizational priorities, complementing security frameworks already in use.

Records-specific standards continue to evolve. Notably, NARA revoked its endorsement of the DoD 5015.2 electronic records management standard in 2022, shifting emphasis toward the Universal Electronic Records Management (ERM) Requirements and the Federal Electronic Records Modernization Initiative (FERMI). For records professionals, the practical takeaway is to ground PII controls in current functional requirements and risk-based frameworks rather than a single legacy certification. Governance also means clear written policy, assigned ownership, staff training, incident-response procedures for suspected breaches, and periodic audits that test whether the controls actually work in practice. Readers exploring related guidance can continue through the privacy and PII topic hub.

Securing records that contain PII is ultimately about discipline applied uniformly: know what you hold, restrict who can touch it, protect it technically, keep it only as long as authorized, and destroy it cleanly when its time has come. Done well, these practices protect individuals, reduce organizational liability, and reinforce public trust.