Practise vocabulary for classifying personal data: PII categories, sensitivity levels, data tagging, and classification frameworks.
0 / 10 completed
1 / 10
PII stands for Personally ___ Information — data that can identify a specific individual.
PII (Personally Identifiable Information) is any data that can identify a specific individual, directly (name, email, SSN) or indirectly in combination with other data (date of birth + ZIP code + gender).
2 / 10
___ PII directly identifies an individual without needing additional data — examples include full name, email address, and passport number.
Direct PII (sometimes called explicit PII) identifies a person on its own. Indirect PII (quasi-identifiers) requires combination with other data to identify an individual. The distinction affects handling requirements.
3 / 10
___ is the process of replacing direct identifiers with reversible coded values, so the data can be linked back to the individual with a key.
Pseudonymisation (GDPR Article 4) replaces identifying fields with artificial identifiers. Unlike anonymisation, it's reversible with the pseudonymisation key. GDPR recognises it as a risk-reduction technique but not a full exemption.
4 / 10
Under most privacy frameworks, ___ data — such as health records, biometrics, and racial/ethnic origin — receives the highest level of protection.
Special category data (GDPR Article 9) includes health data, biometric data, genetic data, racial/ethnic origin, religious beliefs, and sexual orientation. Processing it requires explicit legal basis and additional safeguards.
5 / 10
A data ___ assigns sensitivity labels to data assets (e.g., Public, Internal, Confidential, Restricted) to guide handling and access control.
A data classification scheme categorises data by sensitivity. Higher-classified data requires stricter access controls, encryption, audit logging, and retention limits. Classification enables consistent, scalable privacy governance.
6 / 10
John Doe from the support team sent a Slack message: 'Just ran a query on user data to troubleshoot login issues. It's pulling down names, emails, and phone numbers.' Which of the following best describes the type of PII being accessed in this scenario?
This scenario presents direct contact details (name, email, phone number) associated with a specific user. 'Personally Identifiable Information' (PII) is defined as any data that can be used to identify an individual, and this message clearly contains such information. Options B, C, and D describe different types of data processing techniques, but none accurately represent the PII present in John Doe's Slack message.
7 / 10
During a code review for a new user authentication API endpoint, you see this comment from Sarah (the backend engineer): 'This response includes the `user_id` and `email` fields. We should ensure these are properly masked in production to avoid exposing sensitive data.' What is Sarah primarily concerned about regarding PII?
Sarah's comment highlights a crucial security concern: 'Data leakage.' Exposing sensitive fields like user ID and email in an API response without proper masking can allow unauthorized access to individual user data. Options A, C, and D represent different technical issues, but the core risk here is the potential for PII exposure.
8 / 10
You are reviewing a PR description for a new feature that allows users to download their transaction history. The description states: 'We're providing a CSV file containing all transactions, including the merchant name, date, and amount.' Considering PII classification, which element within this data is MOST likely to require additional protection?
While all listed elements *could* be considered part of a larger data set containing PII, the merchant name presents the highest risk. Knowing where a user has made purchases can strongly indicate their identity and location, increasing the potential for misuse or targeted attacks. Options A, B, and D misinterpret the sensitivity associated with these fields.
9 / 10
During a standup meeting, David (the DevOps engineer) mentions: 'We're implementing differential privacy on our database queries to protect user data. We'll be adding noise to the results to obscure individual records.' What technique is David describing in relation to PII classification?
David is describing 'Pseudonymization,' a process where direct identifiers (like user IDs) are replaced with pseudonyms. Differential privacy adds noise to the data, effectively concealing individual records while still allowing for aggregate analysis. Tokenization and encryption offer different methods of protection but don't align with the specific technique David describes.
10 / 10
Your company has implemented a data classification policy that categorizes sensitive data based on its potential impact. Which category would 'biometric data' (such as fingerprints or facial recognition scans) most likely fall under?
Biometric data is inherently highly sensitive because it directly identifies an individual and can be used for authentication or tracking. This type of data poses a significant risk if compromised, warranting the highest level of protection – 'Confidential.' Options A, B, and D represent different categories based on accessibility and use, but not the specific sensitivity associated with biometric information.
What will I practice in "PII Data Classification Vocabulary"?
This is a Privacy Engineering exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of privacy engineering terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the privacy engineering vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Privacy Engineering exercises?
See the Privacy Engineering exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — privacy engineering vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.