What counts as PII in SOPs, documents and code?
PII is anything that can identify a person on its own or combined with other details. NIST's guide, quoting a definition written for federal agencies, describes it as information that can be used "to distinguish or trace an individual's identity", plus information "linked or linkable to an individual", such as financial or employment details (NIST SP 800-122, April 2010). In company records that covers names and emails in a procedure's sign-off block, customer details pasted into tickets, phone numbers in chat archives, and author names and emails in commit metadata.
Is redaction the same as de-identification?
No; redaction is one technique inside de-identification, and blanking visible names is not always enough. Context can still point to a person, and under the GDPR data that can be attributed to someone with additional information remains personal data (GDPR Recital 26). Even HIPAA's list-based method for health data requires both removing 18 identifiers and that the holder has no actual knowledge the remainder could identify someone (45 CFR 164.514(b)(2)).
Why does redaction in code have to reach the history?
Because a repository keeps every earlier version, a credential or a customer's email deleted from today's files can still sit in an old commit. GitHub's documentation explains that removing sensitive data means rewriting the repository's history, and that if the data is a secret such as a password or token, "as a first step you need to revoke and/or rotate that secret" (GitHub Docs). For a company licensing code with its commit and review history, that history needs checking as well as the latest files. fearofgod.ai de-identifies the data before it goes to buyers. This page is general information, not legal advice.