Is the image of the signature considered PII?

PII by definition is

any information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

And to answer your question, image of signature is a sensitive PII as it can be used to identify a person. As base64 encoding only obfuscate the data, that also shall be considered sensitive and nearly as unsafe as having the cleartext counterpart. You should treat the data as a sensitive PII irrespective of the type of encoding and filename.


Yes, it is.

Some people have well-readable signatures (sometimes even OCR-readable), so an image of the signature is equivalent to the full name of the person who made it.

People who have unreadable signatures can be uniquely identified by cross-referencing with signatures from a different database. There are algorithms which are able to compare signature scans with pretty good accuracy.

Even with a GUID as the name?

I am not sure what you mean with that, but if you mean "create a GUID to uniquely identify each signature-image and store that", then that GUID without the image would not be PII, because you can not tell from the GUID how the signature looks.