Data Minimization: The Privacy Principle Most Companies Ignore

Most privacy conversations focus on protecting data: encryption, access controls, breach response. Those matter. But there's a simpler control that gets far less attention, precisely because it isn't a product you can buy: only collecting and retaining the data you actually need.

The logic is uncomfortable but simple

Data that was never collected can't be breached. Data that's deleted on schedule can't be exposed in an incident five years later. Every field on a signup form, every log retained indefinitely, every "just in case we need it someday" database is a liability sitting on a shelf — useful to the business in theory, valuable to an attacker in practice, and a growing regulatory exposure the longer it sits unused.

Where it tends to go wrong

• Collecting more than the interaction requires. Asking for a date of birth on a newsletter signup when age isn't otherwise relevant.
• No retention policy, or one that isn't enforced. Data from customers who left years ago, sitting in the same database as active customers, with no different handling.
• Logs that capture more than they need to. Debug logs that happen to include full request bodies — which might include passwords, tokens, or personal data — retained far longer than the debugging need justified.
• Third-party sharing by default. Analytics and marketing tools configured to receive full user records when aggregate or pseudonymized data would answer the same business question.

What minimization looks like in practice

1. For every field you collect, ask what breaks if you don't have it. If nothing breaks, don't collect it.
2. Set an actual retention period per data category, and automate deletion — a policy that requires someone to remember to act on it usually doesn't get enforced.
3. Separate what's operationally necessary from what's merely convenient, and treat the second category as opt-in, not default.
4. Audit what third-party scripts and integrations actually receive, not just what you intended them to receive.

The business case, not just the compliance case

Minimization isn't only a regulatory checkbox. A breach of data you never collected costs nothing to disclose, nothing to remediate, and damages no one. The cheapest way to reduce breach impact is to reduce what there is to breach — a principle worth applying before the incident, not after.