How, when and where an entity obtains personally identifiable information (PII) or personal data.