What is PII, and how is it different from personal data?

How do PII and personal data differ?

NIST, the US standards body, defines PII as information that can be used to distinguish or trace an individual’s identity, either alone or combined with other information that is linked or linkable to that person. Names, government ID numbers and biometric records are typical examples.

The UK GDPR and the EU GDPR define personal data as any information relating to an identified or identifiable natural person. Someone is identifiable if they can be picked out directly or indirectly, for example by a name, an ID number, location data or an online identifier. A support conversation can be personal data even with no name in it, if its details point to one person.

Some personal data needs extra protection. Special category data includes health, ethnic origin, religious beliefs and biometric data used to identify someone. Pseudonymised data, such as a record with the name replaced by a code, is still personal data.

A voice is personal data when it can be linked to the person speaking. It counts as biometric data under the GDPR only when it’s processed to identify someone uniquely, as voice ID systems do.

Why does personal data matter for a website voice agent?

People say more than they type. In a voice conversation, a caller may give their name, email address, company or account details, or describe a problem that identifies them, without being asked. Once the agent transcribes and stores those details, they’re personal data under data protection law.

So decide before launch what the agent should and shouldn’t ask for, who can read transcripts and how long they’re kept.

How Kawl Now handles personal data

Kawl Now saves the topic a caller types and a text transcript of the conversation. It doesn’t detect or remove personal details from either, so a name or email address a caller says appears in the transcript, and in the summary line, which is the start of the caller’s own words. No call audio is recorded.

Automatic insights send callers’ words from recent calls to an OpenAI model and show short exact quotes in your dashboard, API and MCP. Email addresses, long numbers and links are masked before analysis. Names aren’t masked, although the model is told to leave them out.

If you turn on human handover, an early release, a caller who asks for a person types their name. Your team hears that name and a short AI-written summary of the issue in a private briefing, then Twilio connects the call.

The agent has no account access and can’t look up or change customer records, so callers don’t need to share account details for it to help. If you’d rather they didn’t, say so in the greeting and the agent’s instructions, then test what it actually says.

Before a call starts, the widget tells callers that starting means microphone use and a saved transcript, and that they’re speaking with AI. Email notices to the workspace owner never include caller names, transcripts or summaries.

There are no retention settings or automatic deletion yet. Transcripts are kept until you ask for them to be deleted, and export and deletion are handled on request.

Common questions