What is data minimization?

Three separate constraints

Minimization is usually stated as one idea but operates as three:

1. Collect less — only fields with a defined use
2. Keep it shorter — retention tied to purpose, not to disk being cheap
3. Use it narrowly — the purpose you collected it for, not every purpose you later think of (this is purpose limitation)

Most organizations attempt the first, ignore the second, and violate the third without noticing.

Why it is the highest-leverage control

Every other privacy control is ongoing work. Encryption must be maintained. Access reviews must be repeated. Vendor assessments expire.

Data you never collected requires none of it. It cannot be breached, subpoenaed, requested under a DSAR, mishandled by a vendor, or found years later in a system nobody remembers.

The same logic applies to deletion: a field you dropped last year is not part of this year’s incident.

The form question

Look at your highest-traffic form and ask of each field: what happens if this is blank?

If the answer is “nothing, we just like having it,” it is costing you. Every optional field:

• Reduces conversion
• Expands what a breach exposes
• Widens what a DSAR must return
• Adds something to explain if collection is ever questioned

Date of birth to confirm eligibility is justifiable. Date of birth because the CRM has a field for it is not.

Retention that is actually defensible

“We keep everything forever” is not a retention policy, and neither is a policy nobody executes. A defensible approach:

• Tie each category to a stated purpose and period. Transaction records for the tax period. Consent records for the exposure window — for TCPA purposes, the statute of limitations is four years, so shorter schedules delete the evidence you will need.
• Automate the deletion, and monitor that it ran.
• Scope every deletion job. A retention job without an owner filter will eventually run against everything. Read the WHERE clause aloud before it goes near production.
• Exempt what must survive, deliberately and in writing — anything cited in published material, anything under legal hold.

Minimization and consent interact

There is a tension worth naming. Minimization says collect less. Consent evidence says record more.

They resolve cleanly once you separate the data from the record about the data. Collect fewer fields; record more thoroughly what the person agreed to regarding the fields you did collect. The disclosure text, the recipients, and the terms in force are not personal data — they are context — and keeping them does not enlarge your exposure while materially strengthening your position.

---

General information, not legal advice.