How To Create PII Safeguarding Procedures (Step-By-Step)

Personal information rarely stays in one system. An employee record may begin in an application form, move through email, payroll, cloud storage, a service provider, and a paper file, then remain in a backup long after the main record is deleted. A policy that simply says “protect PII” does not tell employees what to do at any of those handoffs.

This guide explains how to create PII safeguarding procedures step-by-step. It gives you an eight-step operating method, a copy-ready procedure template, a responsibility matrix, handling rules for paper and digital records, and a completed employee direct-deposit record example.

What Should PII Safeguarding Procedures Accomplish?

PII safeguarding procedures turn a privacy or information security policy into repeatable work. They tell people how to identify personal information, decide who may use it, protect it in each medium, retain it for an approved period, dispose of it securely, and escalate a suspected loss or disclosure.

The U.S. Department of Labor defines PII as information that can distinguish or trace an individual’s identity, alone or when combined with linked or linkable information. That definition matters because a record can become identifying through combination. A job title may be ordinary data, but a job title, small office location, and medical accommodation can identify one person.

NIST SP 800-122 provides context-based guidance for identifying PII, selecting protection levels, safeguards, and incident response. The publication is written for federal agencies, so a private business should adapt its control ideas to its own obligations rather than treating the document as a universal legal rule. The NIST Privacy Framework is another voluntary resource that helps organizations identify and manage privacy risk.

Your procedure should complement, not duplicate, your broader information security policy. The policy states the rules and management intent. The procedure assigns roles, decision points, required records, and specific handling actions.

Step 1: Define Scope, Roles, and Decision Rights

Begin with the records, people, locations, and systems the procedure covers. Include customer, employee, applicant, contractor, vendor, and website-user information when those groups are relevant. Cover paper files, email, chat, shared drives, cloud applications, mobile devices, removable media, backups, and records held by service providers.

Then assign decisions to named roles. A small company may combine several roles, but it should not leave the decisions ownerless. If the company has a privacy lead or data protection officer, align the procedure with the documented data protection officer responsibilities.

Role	Required decision	Evidence
Procedure owner	Approves the procedure, exceptions, and annual review	Approved procedure and review log
Information owner	Classifies a record type and approves access	Inventory and access matrix
System owner	Implements storage, logging, backup, and deletion controls	System settings and review records
Managers	Confirm business need and report role changes	Access request or removal record
Employees and contractors	Follow handling rules and report incidents	Training acknowledgment and incident report

Step 2: Inventory and Classify PII

Create one inventory row for each meaningful record type, not for every individual file. Examples include employee personnel files, direct-deposit instructions, customer billing profiles, support recordings, job applications, background checks, and website lead records.

FTC business guidance recommends inventory, minimization, safeguards, training, provider controls, disposal, and incident planning. Its inventory guidance asks businesses to trace what information they receive, where it enters, where it is stored, who can access it, and how it moves through the business.

• Record type: the business name for the collection of records.
• Data elements: the personal information contained in the record.
• Purpose: the approved business reason for collection and use.
• Source and entry point: who provides the data and how it arrives.
• Owner and approved users: who makes decisions and who may access it.
• Locations and systems: every approved paper, device, application, backup, and vendor location.
• Classification: the handling level based on sensitivity and likely impact.
• Retention trigger and period: the event that starts the clock and the approved duration.
• Disposal method: how paper and digital copies become unreadable or unrecoverable.

Use the company classification scheme rather than inventing a PII-only scale. The Bizmanualz guide to confidential information includes a classification register and handling matrix that can accommodate personal, financial, commercial, and technical records.

Step 3: Limit Collection, Use, and Access

For each inventory row, ask whether every data element is necessary for the stated purpose. Remove fields that are collected only from habit. When a field is necessary, define approved uses so that information gathered for payroll, hiring, billing, or customer support does not quietly become available for unrelated purposes.

Build access by role, not by personal preference. The DOL’s federal handling reference states that only people with an official need to know should have access to its systems of records. A private business can apply the same operating principle by requiring the information owner to approve access, limiting administrators, and recording the reason for each role’s access.

• Require a manager and information owner to approve new access.
• Give users the lowest level of access needed for their work.
• Separate viewing, editing, exporting, approving, and deleting permissions where the system allows it.
• Review access on a fixed schedule and after transfers, departures, vendor changes, or system migrations.
• Remove access promptly when the business need ends.
• Document emergency access and review its use after the event.

Step 4: Set Storage and Transmission Rules

Write separate rules for paper, local devices, managed repositories, email, portable media, backups, and verbal disclosure. A rule such as “use encryption” is incomplete unless employees know which approved tool to use, who can approve an exception, and what record proves the transfer was completed correctly.

Medium	Minimum handling rule	Prohibited shortcut
Paper	Keep in controlled work areas and locked storage when unattended	Leaving files on desks, printers, or open shelves
Managed system	Use role-based access, unique accounts, logging, and approved backups	Shared accounts or unapproved exports
Email or transfer	Verify the recipient and use the approved protected channel	Sending sensitive attachments through personal email
Portable device or media	Use company-managed, encrypted equipment with loss reporting	Copying records to personal phones or unapproved drives
Verbal or visual	Confirm who is present and prevent unauthorized viewing or hearing	Discussing records in public or displaying them on an unlocked screen

Record the technical controls in the applicable system documentation. A system security plan can describe how a particular system implements access, encryption, logging, backup, and incident controls, while the PII procedure tells employees how to use those controls.

Step 5: Set Retention and Secure Disposal Rules

Do not write “retain as required” and leave the decision to each employee. For every record type, specify the retention trigger, the approved period, any legal-hold exception, the system of record, and the authorized disposal method. Obtain legal guidance for statutory periods that apply to your jurisdiction, industry, contracts, and record type.

The FTC advises businesses to keep sensitive data only while there is a legitimate business or legal need and to use a written retention policy. It also recommends making paper unreadable through appropriate destruction and using secure erasure for digital storage rather than assuming an ordinary delete command removes recoverable data.

• Authorize disposal through the record owner or an approved automated rule.
• Suspend routine disposal when a legal hold, investigation, or contractual requirement applies.
• Destroy paper with an approved cross-cut shredding or destruction service.
• Use the approved secure-erasure or media-destruction method for devices and storage media.
• Include local copies, exports, temporary files, shared folders, and vendor-held copies in the disposal task.
• Keep a disposal record for high-risk collections, including date, scope, method, and responsible person.

Step 6: Control Service Providers

List every provider that receives, stores, processes, transmits, supports, or can administratively access PII. This includes payroll processors, benefits administrators, cloud applications, managed service providers, background-check vendors, shredding companies, call centers, and backup providers.

The FTC advises businesses to investigate providers’ security practices, put security expectations in writing, verify compliance, and require incident notification. Your procedure should therefore define a due-diligence owner, minimum contract terms, approval before data transfer, ongoing review, and return or deletion requirements at termination.

Step 7: Train Employees and Verify the Procedure

Train employees on the actions they perform, not only on definitions. A payroll administrator should practice recipient verification and protected transfer. A manager should practice access removal after a role change. A remote employee should know where paper may be stored and how it must be disposed of.

Training should occur before access is granted, after material procedure changes, and on a recurring schedule. Test the procedure through access reviews, sample record tracing, disposal checks, vendor reviews, restore tests, and incident exercises. Keep evidence of attendance, findings, assigned corrections, and completion.

Step 8: Define Incident Escalation

Employees should not decide whether a misplaced file or misdirected email is serious enough to report. Define reportable events broadly, give employees one immediate reporting route, and let the incident team assess impact and notification duties.

• Loss or theft of paper, a device, or removable media containing PII.
• Email, mail, upload, or verbal disclosure to the wrong recipient.
• Unauthorized access, export, download, screenshot, or sharing.
• Malware, suspicious login, or account compromise involving a PII system.
• A vendor incident, unavailable record, or failure to return or delete data.
• Improper disposal or discovery of records beyond their retention period.

Require the employee to preserve evidence, avoid forwarding the information further, and contact the incident lead immediately. The incident lead should contain the exposure, record the facts, involve legal and technical specialists when needed, determine notification duties, correct the control failure, and document closure. The FTC’s business guide recommends having a response plan, assigning a senior coordinator, investigating promptly, and considering who must be notified.

Copy-Ready PII Safeguarding Procedure Template

Copy the template below into your controlled procedure format. Replace every bracketed field, attach the current inventory and access matrix, and have the responsible owner approve it before use.

Completed Example: Employee Direct-Deposit Records

This hypothetical example shows how one small business can turn the template into specific instructions. It is an operating example, not a universal retention rule.

Field	Completed decision
Record type and purpose	Employee direct-deposit instructions used only to establish and maintain payroll payment
Data elements	Employee name, bank name, routing number, account number, account type, authorization, and effective date
Owner and classification	Payroll manager, restricted personal and financial information
Approved users	Two payroll administrators and the finance controller; IT may administer the system without routine access to record contents
Collection	Employee submits through the approved payroll portal; email and paper submission require payroll manager exception approval
Storage	Payroll platform and restricted finance folder; no local desktop or personal-device copies
Transmission	Approved payroll portal or protected transfer after payroll verifies the recipient through a known channel
Access review	Quarterly and immediately after payroll or finance staffing changes
Retention and disposal	Follow the approved payroll retention schedule and legal holds; securely erase exports and shred approved paper copies when eligible
Provider control	Payroll provider is reviewed annually, has written security and incident terms, and confirms return or deletion at termination
Incident route	Report immediately to the payroll manager and IT incident lead; preserve the message or audit log and do not resend the data

The example exposes decisions that a generic policy leaves unresolved. Payroll knows where the record may enter, who may use it, where copies may exist, what triggers a review, which provider terms matter, and whom to contact when something goes wrong.

Frequently Asked Questions

What Is a PII Safeguarding Procedure?

A PII safeguarding procedure is a controlled set of instructions for identifying, collecting, using, accessing, storing, transferring, retaining, disposing of, and responding to incidents involving personally identifiable information. It assigns owners, actions, approvals, and required records.

What Information Should Be Treated as PII?

Treat information as PII when it can identify or trace a person by itself or when combined with other linked information. Apply stronger handling rules when the record contains sensitive identity, financial, health, credential, employment, or location data.

How Often Should PII Access Be Reviewed?

Set a recurring review based on risk, such as quarterly for restricted payroll or financial records, and also review access after hiring, transfers, departures, vendor changes, incidents, and system migrations. The information owner should document the decision and removed permissions.

How Should a Business Dispose of PII?

A business should dispose of PII only after the approved retention period and legal holds have ended. It should make paper unreadable, securely erase or destroy digital media, include copies and exports, require provider deletion, and keep evidence when the record’s risk warrants it.

Who Should Own PII Safeguarding Procedures?

A privacy, security, compliance, or operations leader should own the procedure, depending on the company. Information owners approve classification and access, system owners implement controls, managers report role changes, and every user follows the handling and incident-reporting rules.

Put the Procedure Into Your Security Manual

A safeguarding procedure becomes useful when it governs real records and systems. Start with the two or three PII collections that could cause the greatest harm, complete the inventory and access matrix, assign the owners, test one record from collection through disposal, and correct the gaps you find.

Then place the approved procedure beside the company’s access, acceptable use, incident response, vendor, records, and security controls. Review the complete set whenever a system, provider, business purpose, or legal obligation changes.