What it means
Minimization can reduce fields, granularity, frequency, access, copies, or retention time. It should be considered in product design, analytics, logging, testing, and vendor integrations.
Why it matters
Less unnecessary data means a smaller attack surface, lower breach impact, simpler compliance, and fewer opportunities for unexpected secondary use.
Practical focus
- Define the purpose before collecting data
- Challenge each field and retention period
- Use aggregation or less precise data where possible
- Reassess collection when the service changes
Common mistakes
- Collecting data because it may be useful later
- Keeping default logs indefinitely
- Minimizing only the user interface
- Ignoring copies held by vendors and test environments
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: