If this is about GDPR PII- with all respect, GDPR is a legal regime, so on these topics you have a responsibility to inform and heed the advice of your counsel, and no one else, especially randos at Stack Overflow.
That said, two points: my IANAL conversations indicate that these sorts of numbers are NOT PII in the GDPR sense, for a few reasons; but more importantly, while it is wise to consolidate identity information, this should not necessarily be seen as a strategy for descoping systems for GDPR, the way that one might for PCI. GDPR data doesn't "bleed" the way PANs do. It's much more of an MDM (master data management) kind of problem.
GDPR grants rights to individuals that apply WHEREVER data about them or owned by them may reside. It doesn't have to be in a table with foreign keys into a User table with first and last name fields. ANY data ANYWHERE that you would not have had possession of, had you never had this person as an employee, is potentially in scope.
That said, employer-employee relationships are generally more straightforward under GDPR because there already are data lifecycles around employee onboarding and departure, and employment contracts typically have language around data like photographs and medical data, and there are already HR rules around "processing" for events like promotions and raises and assignments and so forth. GDPR is more relevant and urgent for your human customer data.
Back to the badge/employee id problem. There might be language specific to these kinds of ids in GDPR legislation, I don't remember offhand, but generally speaking- those IDs are not attributes owned by the human to whom they are assigned. They merely identify that human in the context of your company, and they would cease to do so after that human left your employ. So, top level, not PII.
You can retain the fact that they were assigned to a human after the human leaves, and even if you happen to delete all the attributes that are custody of the human, you can still keep a record that those IDs were once assigned to a human. Whether you are able to retain the human's name following their departure and following a subject delete request- my recollection is that there are circumstances in which you must still retain that data for some period of time, but not the details- which doesn't matter because I am just a rando on SO and not your counsel. Cheers!
