The category is wider than most people assume. Direct identifiers such as a name or phone number are obvious. Indirect identifiers such as an IP address, a device identifier or a combination of details that narrows down to one person can also count, and privacy laws generally treat them that way. Different regimes use different terms — GDPR says personal data, HIPAA says protected health information — but the underlying idea is the same.
The practical discipline is data minimisation. Every extra field on a form is another piece of PII you now have to secure, retain responsibly and be able to delete on request. Asking for a phone number you will never call is not a neutral choice; it is added obligation for no return.
Lead capture is PII collection by definition, so it is worth designing deliberately. In Clerkzo you choose the fields the widget asks for, whether it collects them conversationally or as an in-chat form, and everything lands in one leads inbox rather than being scattered across inboxes and spreadsheets — which is what makes finding and deleting a person's data realistic when someone asks.
Related guides
Related terms
Browse all 104 terms- Data RetentionData retention is the policy and practice of deciding how long you keep each type of data before deleting it, based on how long you actually need it and what the law requires or permits.
- Data ResidencyData residency refers to the country or region where an organisation's data is physically stored, and to any requirement that it stay within a particular jurisdiction.
- Encryption at RestEncryption at rest means data is stored in an encrypted form, so that anyone who obtains the underlying storage — a disk, a backup, a database file — cannot read it without the decryption key.
- User ConsentUser consent is a person's freely given, specific and informed agreement to a stated use of their personal data, indicated by a clear affirmative action rather than silence or a pre-ticked box.