Skip to content
ENExplore Calculators

PII Exposure Calculator

Quantify PII breach exposure: records at risk, field sensitivity, identity-theft potential, notification cost and regulatory fines.

About PII Exposure Calculator

What makes a breach expensive is the field combination, not the record count alone: a name and email is a nuisance, while a name with a government identifier is a durable identity-theft kit that cannot be reissued like a card number. Credential exposure is discounted by how well the secrets were protected, which is the one field where prior engineering decisions materially change the outcome. Fine exposure is modelled well below the statutory maximum because enforcement rarely reaches it. Cost per record is the figure that survives contact with a board: it converts an abstract breach into a number that can be compared against the cost of the control that would have prevented it.

Formulas

PII Exposure

sensitivityIndex = 0.9 × (1 for names/email + 3 for government ID + 3 for financial + 2.5 for health + 2 for credentials); costs scale notification and remediation by record count and sensitivity.

sensitivityIndex
Weighted sensitivity of the exposed field combination
identityTheftRisk
Probability the combination supports identity theft, reduced where credentials were properly hashed
maxFine
4% of annual revenue, the GDPR upper tier

Modelled regulatory exposure

expectedFine = maxFine × min(0.15, sensitivityIndex ÷ 10 × 0.15) — enforcement rarely reaches the statutory maximum, so the model caps the modelled exposure at 15% of it.

maxFine
Statutory ceiling
sensitivityIndex
Drives how seriously the exposure is treated

Worked example

With the default values below, PII Exposure Calculator returns Total Exposure Cost of $16,446,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Records exposedaccepts 1–5,000,000,000 records
250,000 records
Names and email addresses included
Yes
Government identifiers included
Yes
Payment or bank details included
No
Health data included
No
Passwords or authentication secrets included
Yes
Protection applied to the exposed dataone of Strong encryption, keys not exposed — 0.05, Salted Argon2 or bcrypt hashes — 0.3, Unsalted or fast hashes — 0.7, Plaintext — 1.0
Unsalted or fast hashes — 0.7
Notification and support cost per recordaccepts 0–1,000 currency/record
12 currency/record
Credit monitoring and remediation per recordaccepts 0–5,000 currency/record
45 currency/record
Annual revenueaccepts 0–1,000,000,000,000 currency
400,000,000 currency

Results

Total Exposure Cost
$16,446,000
Field Sensitivity Index
5.40 / 10
Identity Theft Potential
64.0%
Notification and Support
$3,000,000
Remediation and Monitoring
$12,150,000
Maximum Regulatory Fine at 4% of Revenue
$16,000,000
Cost per Record
$65.78

Step by step

  1. 1Values used
  2. 2PII Exposure
  3. 3Modelled regulatory exposure
  4. 4Total Exposure Cost= 16,446,000
  5. 5Field Sensitivity Index= 5.40 / 10
  6. 6Identity Theft Potential= 64.0
  7. 7Notification and Support= 3,000,000
  8. 8Remediation and Monitoring= 12,150,000
  9. 9Maximum Regulatory Fine at 4% of Revenue= 16,000,000

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is PII Exposure calculated?

sensitivityIndex = 0.9 × (1 for names/email + 3 for government ID + 3 for financial + 2.5 for health + 2 for credentials); costs scale notification and remediation by record count and sensitivity. What makes a breach expensive is the field combination, not the record count alone: a name and email is a nuisance, while a name with a government identifier is a durable identity-theft kit that cannot be reissued like a card number. Credential exposure is discounted by how well the secrets were protected, which is the one field where prior engineering decisions materially change the outcome. Fine exposure is modelled well below the statutory maximum because enforcement rarely reaches it.

Why does PII Exposure matter?

Cost per record is the figure that survives contact with a board: it converts an abstract breach into a number that can be compared against the cost of the control that would have prevented it.

What values do I need to enter?

This calculator takes 10 inputs: Records exposed, Names and email addresses included, Government identifiers included, Payment or bank details included, Health data included, Passwords or authentication secrets included, Protection applied to the exposed data, Notification and support cost per record, Credit monitoring and remediation per record, Annual revenue. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is a government identifier weighted above payment data?

Because it cannot be reissued. A compromised card is cancelled in a day; a national identifier follows the person for life and underpins account opening everywhere, which is why remediation costs run for years.

Are these per-record figures reliable?

They are planning figures, not actuals. Published averages hide enormous variation by sector and jurisdiction, so replace the defaults with your own legal and notification quotes as soon as you have them.

Related Calculators

PII Exposure Calculator – Calculate Total Exposure Cost