Pii Handling

PII handling

Personal data is a liability that compounds. Every field you keep is something you can leak, something a subpoena can reach, and an obligation you carry until you delete it. The discipline is to collect less, guard what stays, and purge on a clock instead of hoarding by default.

Method

1. Classify each field before it lands. Tag every column public, internal, PII, or sensitive PII (health, biometric, financial, government id). Keep the map in code or a data catalog so masking and retention rules key off the tag, not off a person remembering which column held a birth date.
2. Minimize at the point of collection. Store what you use and nothing else: the last four digits of a card, not the full number; an age band, not a date of birth; a coarse region, not raw coordinates. A field you never collected is a field that cannot leak.
3. Mask on the way out. Redact in logs and errors (a***@x.com), tokenize card numbers, and back reads with database views that expose masked columns by default, so a stray SELECT * does not spill raw values into a dump.
4. Pseudonymize before data reaches analytics. Swap direct identifiers for a per-subject token in the warehouse and in non-production copies, and keep the re-identification key in a separate, tightly scoped vault. Analysts get the shape of the data without the people in it.
5. Set retention per class and enforce it in a job. Give each dataset a TTL (support tickets two years, auth logs 90 days) and run a scheduled purge that deletes rows for real. "Keep forever" must be a deliberate choice, never the default nobody revisited.
6. Build one lookup path that finds every copy. An access or deletion request has to reach the primary store, replicas, backups, the search index, and analytics. A GDPR or CCPA erasure that skips the warehouse copy is not an erasure.
7. Encrypt sensitive PII at the field level. Put envelope encryption on government ids and health data on top of disk encryption, so a raw table dump is not a breach by itself.

Checks

• Pick a user id: can you list every place their personal data lives in under a minute?
• Does a raw email, card number, or national id ever surface in logs, stack traces, or analytics events?
• When retention expires, does a job actually delete the rows, or does the policy live only in a wiki page?

Boundaries

Classification thresholds and lawful basis are legal calls; defer to your data protection officer. The encryption mechanics belong to data-encryption. This skill decides what to protect, how coarsely to keep it, and for how long.