PII Record Exposure Calculator

Work out pii record exposure instantly with clear inputs, formula shown and shareable results.

About PII Record Exposure Calculator

Regulatory obligations are counted in data subjects, not rows, so a dataset with several records per person overstates the notification population. What drives severity is the field mix: a record with two or more direct identifiers such as name plus national ID is immediately identifying, while quasi-identifiers alone may still re-identify when combined, which is the basis of k-anonymity analysis.

Formula

Exposure scope

data subjects = records x distinct-subject share; data points = records x personal fields per record

Worked example

With the default values below, PII Record Exposure Calculator returns Distinct data subjects affected of 408,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Records in the affected datasetminimum 1: 480,000
Personal data fields per recordminimum 1: 12
Direct identifiers per recordminimum 0: 3
Share of records tied to distinct individualsaccepts 1–100 %: 85 %

Results

Distinct data subjects affected: 408,000
Individual personal data points exposed: 5,760,000
Individuals in scope for notification: 408,000
Re-identification assessment: High - directly identifying without additional data

Step by step

1Values used
2Exposure scope
3Distinct data subjects affected= 408,000
4Individual personal data points exposed= 5,760,000
5Individuals in scope for notification= 408,000
6Re-identification assessment= High - directly identifying without additional data

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does GDPR require notifying every affected individual?

Only when the breach is likely to result in a high risk to their rights and freedoms. The supervisory authority must be notified within 72 hours regardless, where the risk is more than negligible.

Does encryption remove the notification duty?

Strong encryption with keys not compromised is explicitly recognised as a mitigating factor and commonly removes the duty to notify individuals, though the assessment must still be documented.