Information Security

Questions tagged [pii]

Ask Question

The tag has no usage guidance.

16 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
4
votes
2answers
139 views

Documentation for GDPR best practices for partially masking email addresses

I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...
1
vote
1answer
61 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
2
votes
1answer
96 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
1
vote
1answer
222 views

How can I encrypt messages sent over AWS PrivateLink?

I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
0
votes
0answers
41 views

Do security breach victims have any meaningful recourse?

OPM Breach Anthem Health Care Equifax The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...
1
vote
1answer
160 views

Can you tell me if my design is secure?

I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows. I'm running three ...
3
votes
4answers
2k views

Are employee or badge numbers PII?

We're looking at implementing an Identity Management/Lifecycle system. We're looking at aggregating all our authentication into this system. However, one area of concern is same-name employees, so ...
1
vote
0answers
35 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
34
votes
6answers
9k views

Is a standalone phone number considered Personally Identifiable Information?

Personally Identifiable Information (PII) is defined (the example below is from NIST) as (emphasis mine) Information that can be used to distinguish or trace an individual's identity, such as ...
0
votes
1answer
91 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
9k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
0
votes
1answer
195 views

How to securely collect email addresses through a third party website

I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list. Flow: User goes to a website hosted by unbounce.com that uses my website's ...
2
votes
1answer
105 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
-1
votes
1answer
38 views

DLP Tool for requirement [closed]

Is there any DLP tool with default policies to comply with south african laws and regulations on PII ?
4
votes
1answer
88 views

How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

I have a website and mobile app that doesn't store data or PII. Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
0
votes
1answer
581 views

Data Masking in a database [closed]

Background The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...