Skip to content
عربيSign in

Get the app

Study guide · 2.1

Understand how to protect others’ personally identifiable information

Personally identifiable information (PII) is any information that can identify a person, alone or combined with other data. At an advanced level you are trusted with other people's data, so you protect it online and at work, handle any account details you learn responsibly and never share someone's information without their permission.

A study feature written by ExamDragon, not part of the real exam. Each heading is one of Certiport's skills for this objective.

2.1.1Explain the need for and how to achieve online privacy

  • PII includes names, addresses, phone numbers, email addresses, ID numbers, photos, location data and account numbers; health and financial data are especially sensitive.
  • Privacy matters because exposed PII can lead to identity theft, fraud, stalking, discrimination or embarrassment.
  • Share the minimum needed, review privacy settings on each service and limit who can see posts and profiles.
  • Use secure (HTTPS) sites, strong unique passwords and multifactor authentication on accounts that hold other people's data.
  • Privacy laws differ by country and region (the EU's GDPR is one example), but most require care, a clear purpose and a lawful basis, such as consent, for using personal data.

Example: A volunteer collecting sign-ups for an event uses a form that asks only for a name and email, not a date of birth or home address, because nothing more is needed.

2.1.2Explain the need for and how to achieve privacy at the workplace

  • Access customer and colleague data only when your job requires it (need to know), and only through approved systems.
  • Lock your screen when you step away, keep a clear desk and position screens away from public view.
  • Send files with personal data only to the right people, check recipients before sending and use BCC for group emails to outsiders.
  • Store and dispose of personal data as your organisation's policy says, including shredding printed copies.
  • Your employer may monitor work devices and accounts, so keep personal matters off them and follow the acceptable use policy.

Example: An HR assistant locks the computer before leaving the desk and sends a salary spreadsheet only through the approved secure folder, not as an email attachment.

2.1.3Explain the responsibility that comes with knowing another’s password and account information

  • If you learn someone's password, by accident or because they told you, do not use it or keep a record of it.
  • Tell the owner promptly so they can change it; in a workplace, tell IT if company accounts are involved.
  • Using another person's account without permission can break policy and, in many places, the law.
  • Even with permission, logging in as someone else makes your actions look like theirs and weakens accountability.
  • Shared access should use proper tools, such as delegated access or a password manager's sharing feature, rather than passing passwords around.

Example: A colleague's password is written on a note stuck to their monitor; you do not try it, and you suggest they change it and store it in a password manager.

2.1.4Avoid broadcasting other people’s information without permission

  • Ask before posting photos, videos or stories that include other people, and respect a 'no'.
  • Do not tag people, share their location or forward their private messages or screenshots without consent.
  • Children's information needs extra care; follow the rules of the school or organisation and the wishes of parents.
  • Once information is posted, copies can spread and are very hard to remove.
  • If you share something by mistake, remove it quickly and tell the person affected.

Example: After a team lunch, a staff member asks everyone before posting a group photo and blurs the face of one colleague who prefers not to appear online.

Key terms

PII
Personally identifiable information: data that can identify a specific person.
Data minimisation
Collecting and keeping only the personal data that is truly needed.
Need to know
The rule that people should access only the data their task requires.
Consent
A person's clear permission for their information to be used or shared.
BCC
Blind carbon copy: email recipients who cannot see each other's addresses.

Easy to confuse

  • Information does not have to include a name to be PII; a combination such as postcode, birth date and job title can identify someone.
  • Being able to see data at work does not mean you are allowed to look at it or share it.
  • Knowing a password with good intentions still does not give permission to use it.

After this guide: You can explain why other people's PII must be protected and apply practical steps online and at work.