Sensitive Personally Identifiable Information

NARA's description

CUI Registry · Sensitive Personally Identifiable Information

A subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements.

a. Examples of stand-alone PII include Social Security Numbers (SSN), driver's license or state identification number; Alien Registration Numbers; financial account number; and biometric identifiers such as fingerprint, voiceprint, or iris scan.

b. Additional examples of SPII include any groupings of information that contain an individual's name or other unique identifier plus one or more of the following elements:

Truncated SSN (such as last four digits)

Date of birth (month, day, and year)

Citizenship or immigration status

Ethnic or religious affiliation

Sexual orientation

Criminal history

Medical information

System authentication information such as mother's maiden name, account passwords, or personal identification numbers

c. Other PII may be "sensitive" depending on its context, such in as a list of employees and their performance rating(s) or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

Safeguarding and/or Dissemination Authority

Basic or

Specified

Banner Marking

Sanctions

Provisional Approval 2018-09-07

Basic

CUI

Markings

Banner marking

CUI

A banner reads CUI for Basic categories and CUI//SP-XXXX for Specified ones, followed by any limited dissemination control such as NOFORN. How the marking rule works, verbatim from 32 CFR 2002.20.

Authorities

The law, regulation or Government-wide policy that makes this information CUI, and whether it does so as a Basic or a Specified authority.

Source: https://www.archives.gov/cui/registry/category-detail/sensitive-personally-identifiable-info.