In short
Personally identifiable information is any data that identifies a person: email, phone, name, postal address, and government identifiers among others. In a marketing pipeline, PII is both the fuel for matching and the thing most tightly governed, which is why how you handle it decides both performance and compliance. Three practices matter most. Hash PII at the source, before it leaves your environment, so raw identifiers never sit on a shared server. Minimize it to what each destination actually needs, rather than sending every field by default. And govern it by the consent collected when it was gathered, so permission travels with the data. Hashing is central but often misread, because a SHA-256 hash is pseudonymized rather than anonymized, so PII obligations continue to apply after hashing. A well-built pipeline treats PII as something to move carefully, not something to copy freely between systems. Datahash hashes at source and stores no PII on host servers in Datahash Cloud.
The three controls that matter
Hash at source, so raw identifiers never leave your systems. Minimize, so each destination receives only the fields it can match on. Carry consent, so every event knows what the person permitted.
How Datahash handles it
Identifiers are SHA-256 hashed at ingestion, delivery is consent-aware, and no PII is stored on host servers in Datahash Cloud.
How much PII should you actually send?
A team is tempted to send full customer records to every platform. Minimizing to the identifiers each destination matches on, hashed at source, keeps match rates high while reducing how much PII leaves the business.
Reference: NIST SP 800-122, guide to protecting PII