PII Handling

PII = any data that can identify a person, alone or in combination with other data. In a higher-education student system, the surface includes:

• Direct identifiers: name, student ID (institutional username/netID, etc.), SSN, government ID, biometrics, photo, voice
• Quasi-identifiers: DOB, ZIP, gender, ethnicity, major, cohort year, country of origin — combine 3 of these and you can usually pick out a single student
• Contact: address, phone, email (institutional and personal), emergency contacts
• Family: parent/guardian names, contact info, financial info, dependent status
• Educational: see ferpa-compliance — this is where the FERPA scope lives
• Financial: aid awards, balances, bank info, payment cards
• Health: disability accommodations, immunization records (often FERPA, sometimes HIPAA — escalate if HIPAA-scope)

The legal regime depends on the data: