Should an identity include Personally Identifiable Information (PII)?

Including personally identifiable information (PII) in identity management systems raises significant privacy and security concerns. PII can be sensitive and risk users’ privacy if mishandled, leading to data breaches or misuse. Best practices in identity management emphasize minimizing the collection and retention of PII whenever possible. By avoiding the inclusion of PII within identity records, organizations can better protect individuals' privacy and comply with various data protection regulations, such as GDPR or CCPA, which advocate for data minimization.

While some may argue for the necessity of PII for user verification or specific business processes, the overarching principle in identity governance often prioritizes security and privacy. Therefore, maintaining identities without PII is seen as a more secure and privacy-friendly approach, fostering user trust and compliance with legal requirements.