In plain English
PII is the data that, if exposed, can directly harm the people it belongs to — through identity theft, financial fraud, or discrimination. Under the Australian Privacy Act, organisations that collect PII have legal obligations around how it's stored, used, protected, and disposed of. A breach exposing PII may trigger Notifiable Data Breaches obligations.
