Information can harm people. Think of being denied mortgage or insurance based on your grocery shopping or online surfing profile. But what exactly is it in information that is harmful, and how can people be protected? The current legal answer is that protection (data protection principles, rights and obligations) is granted when a) there is information b) about or potentially affecting a person c) who is identified or identifiable. This is Personally Identifiable Information (PII). But now that virtually all information is PII, how can law meaningfully protect against information-induced harms?Given modern data collection and processing techniques and unprecedented amounts of data available for analysis, everything can be translated into data and anyone can be identifiable in data sets. Therefore, PII-based legal protection will fail, since a law regulating everything is meaningless. Yet, alternatives for structuring legal protection other than through the concept of PII are lacking. INFO-LEG innovates by looking for substitutes for the notion of PII to fundamentally re-organise legal protection. Promising new organising notions will be found through better understanding of information, how it links to people and harms. The approach is unique in integrating how law, economics, and information studies conceptualise information. INFO-LEG will theoretically and empirically explore external and internal conceptual boundaries of information and produce a multidisciplinary taxonomy of information. The notions from this taxonomy will be assessed on their suitability to substitute PII as new organising notions for legal protection against information-induced harms.The multidisciplinary conceptualisation of information will impact scholarships studying how other areas of law regulate information in digital age: intellectual property (drawing borders of rights in information objects); constitutional law (if data is protected speech); telecommunication and cybercrime.