Personal Information and Identifiability: A CDPSE Privacy Governance Guide
Introduction
Personal Information and Identifiability is a foundational topic in the ISACA CDPSE (Certified Data Privacy Solutions Engineer) Privacy Governance domain. Before an organization can protect privacy, it must answer one basic question: what data counts as personal? Every later privacy control depends on that answer, including data inventories, classification, privacy impact assessments, retention schedules and de-identification techniques. This guide explains why the concept matters, what it means, how it works in practice, and how to answer exam questions about it.
Why Personal Information and Identifiability Is Important
1. It sets the scope of privacy obligations. Laws such as the GDPR, CCPA/CPRA, LGPD, PIPEDA and HIPAA apply only to personal data (or their own defined equivalents). If data is wrongly treated as non-personal, the organization may break the law without realizing it.
2. It drives risk assessment. The more easily data can be linked to an individual, the greater the harm if it is breached or misused. Identifiability is a direct input into privacy risk ratings.
3. It shapes control selection. Encryption, access control, masking, pseudonymization, anonymization and minimization are chosen according to how identifiable the data is.
4. It supports privacy by design. Engineers must know which data elements are personal so they can minimize collection, limit linkage and build safeguards into systems from the start.
5. It affects data sharing and analytics. Organizations often want to share or analyze data. Knowing whether data is truly anonymous or only pseudonymous decides whether privacy rules still apply.
6. It underpins data subject rights. Rights of access, deletion, correction and portability can only be honored if the organization knows where personal information lives and can link it to the individual making the request.
What Personal Information Is
Personal Information (PI), also called Personal Data or Personally Identifiable Information (PII), is any information relating to an identified or identifiable natural person.
Key terms:
- Identified person: someone already singled out from a group, for example by full name together with a photo.
- Identifiable person: someone who can be identified, directly or indirectly, using reasonably available means. Examples include an identifier such as a name, ID number, location data or online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
- Natural person: a living human being. Most laws do not cover legal entities such as corporations, and many do not cover deceased persons, although some jurisdictions and sectors do.
Types of Identifiers
- Direct identifiers: data that identifies a person on its own. Examples are full name, Social Security or national ID number, passport number, email address tied to a name, biometric templates and facial images.
- Indirect identifiers (quasi-identifiers): data that does not identify a person alone but can when combined with other data. Examples are date of birth, ZIP or postal code, gender, job title, IP address, device ID, cookie ID and geolocation. Research by Latanya Sweeney famously showed that ZIP code, birth date and gender together can uniquely identify about 87% of Americans.
- Linkable versus linked information: linked information is already tied to an individual. Linkable information could be tied to an individual when combined with other available data.
Sensitive Personal Information (Special Categories)
Some personal information carries higher risk and needs stronger protection. It typically includes:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data used for unique identification
- Health data
- Sex life or sexual orientation
- Criminal convictions (often treated separately)
- Financial account data, precise geolocation and government IDs (under laws such as the CPRA)
- Children's data (often given special treatment)
How Identifiability Works
Identifiability is a spectrum, not a yes-or-no switch. Data can be placed along a continuum:
1. Explicitly personal / identified data: direct identifiers are present.
2. Potentially identifiable data: quasi-identifiers are present and could be combined to identify someone.
3. Pseudonymized data: direct identifiers are replaced with tokens or codes, but the organization (or someone else) holds a key or extra information that allows re-identification. Under the GDPR, pseudonymized data is still personal data.
4. De-identified data: identifiers are removed or transformed so the data cannot reasonably be linked to an individual. The legal standard depends on the jurisdiction. For example, HIPAA offers a Safe Harbor method (removing 18 specified identifiers) and an Expert Determination method.
5. Anonymized data: data that has been irreversibly altered so that no individual can be identified by any means reasonably likely to be used. Truly anonymous data falls outside the GDPR.
6. Aggregated data: statistical summaries about groups, such as counts and averages. These are generally non-personal if the groups are large enough to prevent singling out.
The Reasonableness Test
Most regulations ask whether identification is possible using means reasonably likely to be used, by the controller or by any other person. Factors include:
- Cost and time needed to identify
- Available technology, both now and expected in future
- Availability of auxiliary datasets, such as public records and social media
- The motivation of an attacker
- Contractual, technical and organizational controls that stop re-identification
Re-identification Risks
The three main re-identification risks, recognized by the Article 29 Working Party (now the EDPB), are:
- Singling out: isolating the records of one individual within a dataset.
- Linkability: linking two or more records about the same individual, either within one dataset or across datasets.
- Inference: deducing the value of an attribute with significant probability from other attributes.
Common De-identification Techniques
- Suppression / removal: deleting identifiers or whole records.
- Generalization: reducing precision, such as replacing an exact age with an age range or a full ZIP code with its first three digits.
- Masking: hiding parts of values, for example showing only the last four digits of a card number.
- Tokenization: replacing values with tokens. This is reversible through a token vault.
- Hashing: one-way transformation. It is vulnerable to dictionary attacks unless salted or keyed, and is generally considered pseudonymization.
- Encryption: reversible with the key. It protects confidentiality, but encrypted personal data is still personal data.
- Noise addition / perturbation: slightly altering values.
- Data swapping: exchanging attribute values between records.
- K-anonymity: each record cannot be distinguished from at least k-1 others on its quasi-identifiers.
- L-diversity: each equivalence class contains at least l well-represented values for sensitive attributes.
- T-closeness: the distribution of sensitive attributes in each class is close to their distribution in the overall dataset.
- Differential privacy: a mathematical guarantee that adding or removing one individual barely changes the output. It is used in statistical releases.
- Synthetic data: artificially generated data that keeps statistical properties without real records.
Identifiability in Context
The same data element may or may not be personal depending on context:
- An IP address can be personal data when an ISP, or a website working with an ISP, can link it to a subscriber. The CJEU's Breyer case confirmed that dynamic IP addresses can be personal data.
- A job title like "CEO of Company X" identifies a single person.
- A photo of a crowd may not identify anyone. A close-up image processed with facial recognition does.
- Location data repeated over time creates a unique pattern that identifies a person even without a name.
Governance Activities Linked to Identifiability
- Data inventory and mapping: catalog what personal information exists, where it flows and who accesses it.
- Data classification: label data as public, internal, confidential, personal or sensitive personal.
- Privacy Impact Assessments (PIA/DPIA): evaluate identifiability and risk before new processing.
- Data minimization: collect only the identifiers needed for the purpose.
- Retention and disposal: de-identify or delete data when it is no longer needed.
- Third-party contracts: ban re-identification attempts by recipients of de-identified data.
- Periodic reassessment: new datasets and technologies can make previously anonymous data identifiable, so re-identification risk must be reassessed.
Roles and Responsibilities
- The data owner or business owner decides how data is classified and what it is used for.
- The privacy officer / DPO sets policies and definitions for personal information.
- The privacy engineer, the CDPSE role, puts in place the technical controls such as de-identification, tokenization and access control.
- The data custodian runs and maintains the systems that hold the data.
Exam Tips: Answering Questions on Personal Information and Identifiability
1. Think broadly about what counts as personal information. CDPSE follows a wide, GDPR-style view. If data can reasonably be linked to an individual, directly or indirectly, treat it as personal. IP addresses, device IDs, cookie IDs, location data and employee IDs are usually personal information.
2. Pseudonymized does not mean anonymized. A very common trap. If a key, mapping table or extra information exists anywhere that allows re-identification, the data is still personal and privacy obligations still apply. Tokenized, hashed or encrypted personal data remains personal data.
3. Anonymization must be irreversible. When a question asks how to take data out of the scope of privacy law, the answer is true anonymization, not encryption, masking or pseudonymization.
4. Watch for combinations of quasi-identifiers. If a scenario describes a dataset with names removed but still containing birth date, ZIP code and gender, the right conclusion is that re-identification risk remains high.
5. Choose the BEST or FIRST step. ISACA exams favor governance-first answers. Before applying controls, the first step is usually to identify and classify the personal data, through a data inventory or data mapping. You cannot protect what you do not know you have.
6. Link identifiability to risk. When asked how to reduce privacy risk in analytics or data sharing, prefer answers that lower identifiability, such as minimization, aggregation, de-identification or differential privacy, over answers that only add security.
7. Remember the three re-identification risks. Singling out, linkability and inference. Questions may describe one of them without naming it.
8. Context matters. If an answer choice says "it depends on whether the data can be linked to an individual by reasonably available means," it is often correct. Data is not inherently personal or non-personal regardless of context.
9. Sensitive data needs heightened controls. For health, biometric, genetic or children's data, expect answers involving explicit consent, a DPIA, stronger access controls and encryption.
10. Know where hashing and encryption fit. Encryption is a security control that protects confidentiality. It does not change the personal nature of the data. Hashing without a salt can be reversed through lookup or brute-force attacks on small value spaces such as phone numbers.
11. Re-identification risk changes over time. If a question asks about anonymized datasets released long ago, the best answer often involves periodic reassessment, because new auxiliary data and new techniques can increase risk.
12. Contractual controls supplement technical ones. When sharing de-identified data with third parties, a strong answer includes contractual bans on re-identification together with technical de-identification.
13. Eliminate absolute answers. Options with words like "always," "never" or "completely eliminates risk" are usually wrong. Identifiability is about reasonable likelihood, not absolute certainty.
14. Read the perspective of the question. CDPSE is a technical and engineering exam. When a question asks what a privacy engineer should do, favor actionable technical solutions such as tokenization, k-anonymity or data masking in non-production environments, while still respecting governance.
15. Know non-production data use. Using real personal data in test or development environments is a classic exam scenario. The best answer is usually to mask, de-identify or use synthetic data rather than copy production data.
Sample Question Walkthrough
A company replaces customer names with random tokens and keeps the token mapping table in a separate, access-controlled database. How should the tokenized dataset be treated?
A. As anonymous data outside privacy regulations
B. As personal data, because re-identification is possible
C. As public data
D. As aggregated statistical data
Answer: B. The mapping table means re-identification is possible. Tokenization is pseudonymization, so the data remains personal data, although it carries reduced risk.
Key Takeaways
- Personal information is any data relating to an identified or identifiable natural person.
- Identifiability is a spectrum judged by the means reasonably likely to be used.
- Quasi-identifiers can combine to identify individuals.
- Pseudonymized data is still personal data. Only truly anonymized data falls outside scope.
- Identifying and classifying personal data is the foundation of every privacy program.
- On the exam, think broadly, prioritize governance-first actions, and pick answers that reduce identifiability in proportion to the risk.
