To start a PHP session, the session_start() function must be called. This makes the $_SESSION superglobal array available to store and retrieve session data across page requests. Data is stored in $_SESSION like an associative array and persists until the session ends or is destroyed. The session_destroy() function clears the session data. Sessions can enhance security when used with techniques like regenerating session IDs.