What is the difference between PII and sensitive personal information, and does it change how long I keep the records?

Short answer: the two terms describe overlapping but different ideas. The distinction affects how you protect and access records, while the retention period itself is usually set by a separate authority.

PII vs. sensitive personal information

Personally identifiable information (PII) is any information that can be used to identify a specific individual, either on its own or when combined with other data. Common examples include name, address, email, phone number, and account or identification numbers.

Sensitive personal information is a narrower subset of PII whose exposure carries a higher risk of harm — for example, financial details, health information, biometric data, government-issued identifiers, and information about protected characteristics. Many privacy frameworks single this category out for stronger safeguards.

The practical takeaway: all sensitive personal information is PII, but not all PII is sensitive. The more sensitive the data, the more rigorous your controls for access, encryption, transmission, and disposal should be.

Does this change how long you keep records?

Usually no — at least not directly. Retention periods are normally driven by the business, legal, and regulatory value of the record itself, not by whether it happens to contain PII. A records retention schedule sets how long a record series must be kept, regardless of the sensitivity of the personal data inside it.

Where the distinction does matter:

• Data minimization. Privacy principles favor keeping personal data only as long as it serves a legitimate purpose. If PII is no longer needed but the parent record must be retained, consider redaction or de-identification rather than indefinite retention.
• Stronger safeguards while retained. Sensitive personal information typically requires tighter access controls and secure handling throughout its lifecycle.
• Defensible, documented disposition. When the retention period ends, dispose of records containing PII using a method appropriate to the sensitivity — secure deletion or destruction, with the action documented.

Bottom line

Classify the data so you can protect it appropriately, but set retention based on your approved schedule and applicable legal requirements. Treat sensitivity as a driver of how you safeguard and dispose of records, not how long you keep them. For related guidance, see the privacy and PII topic hub.