Data minimization limits the collection, storage, and use of personal data to what is relevant and necessary for a specific purpose. Treat protected information as inherently risky, and first ask whether the analysis needs it at all. section 8.3.1
Apply the strategy through four practical controls:
- Collect only necessary data; require a clear justification for every requested field instead of gathering information “just in case.” section 8.3.1
- Set a retention policy and delete, scrub, or restrict data after it is no longer relevant. section 8.3.1
- Limit access to raw data, avoid insecure channels such as emailed customer-data CSVs, and use approved secure file-sharing methods. section 8.3.1
- Distinguish anonymization, which removes identifying information, from pseudonymization, which substitutes a key while retaining the original data elsewhere. section 8.4
Health-alert model data
A health-alert feature uses diagnosis-related information to retrain its machine-learning model. The team must weigh erasing unnecessary identifiers against replacing them with coded references, then establish reporting guardrails that include minimization, identity protection, and minimum aggregations. section 8.3.4
Figure 8.6 When all else fails, treat protected information as radioactive.
Use the protected-information risk framing as a quick reminder to avoid handling sensitive data when the purpose does not require it. section 8.3.1
