PII includes name, address, SSN, driver's license, financial info. For law firms, client intake forms are full of PII. Encrypt at rest, transmit over HTTPS only, restrict access via authorization, purge on retention schedule. Breaches are reportable and expensive.