Personal data records are pieces of information linked to identifiable people, such as names, email addresses, phone numbers, student IDs, addresses, or account details. In cyber security, the term matters because even a small dataset can create privacy harm, identity theft risk, phishing opportunities, and regulatory exposure.
Attackers often target these records in ransomware and extortion campaigns because they increase pressure on the victim: a claim that personal data was stolen can damage trust even before the technical facts are confirmed. Defenders treat these records as sensitive assets and protect them with access controls, encryption, logging, and data minimization. During an investigation, teams map where personal data is stored, who can access it, and whether logs show export, exfiltration, or unusual account activity. Accurate classification is essential, because the impact of an incident depends heavily on what personal records were actually exposed.