Data Minimization

Data minimization limits the information handled to what the approved purpose needs. It asks whether a field is necessary, how much detail is required, and which copies and users need it.

Reduce detail without breaking the task

A delivery route needs an address, but a regional volume chart may need only regional counts. Removing the address from the chart does not require removing it from the active delivery task. Minimize according to each use.

Where the reduction happens matters as much as whether it happens. A restriction that must hold in a destination has to be applied before the data crosses into it: once a prohibited field lands in a broadly accessible store, deleting it afterward does not undo the exposure — it was readable, it may sit in backups and query logs, and the deletion itself becomes a task with its own completeness problem. Minimizing on the way in is one filter; minimizing after the fact is a cleanup with an audit trail. The practical rule is to decide, for each field, whether the destination is permitted to hold it at all, and to enforce that at the load rather than in the views built on top.

Free text and logs need attention too. Deleting an email column leaves the same email intact if it appears inside a support message.

Check usefulness and exposure together

A smaller dataset is not automatically sufficient or anonymous. Test that the remaining fields support the task and assess whether combinations still identify people. Limit retention and access as complementary controls. Invented test cases can avoid unnecessary production copies, but their coverage still needs checking.

References

• NIST Privacy Framework