Data Minimization

Reduce Breach Impact with Data Minimization

Security controls often focus on stopping unauthorized access. That is necessary, but it leaves another useful question unanswered: if access controls fail, how much valuable data is available to expose? Data minimization reduces that potential impact. The idea is simple: collect sensitive data only when there is a clear need, keep only the fields and copies that serve that need, and remove the data when the required lifetime ends. This is not a replacement for authentication, authorization, encryption, monitoring, or backups. It changes a different part of the risk equation. A system cannot leak a sensitive value that it never collected, and an old copy cannot be stolen after it has been reliably removed.