Data minimization

Data minimization is collecting and retaining only the data a stated purpose requires, a GDPR principle that doubles as security engineering: data never collected cannot be breached, subpoenaed, or leaked. In identity systems it shows up as verifying facts without storing them, keeping digests instead of identifiers, and retaining decisions rather than the raw signals behind them.

The engineering version of the principle is to ask what the system does with a field rather than whether it might be useful. A field read once at decision time and never again does not need to be stored; a field stored for an investigation that has never happened is a liability being carried on the chance of a benefit.

Retaining the decision and its inputs as digests, rather than the raw signals, usually satisfies the investigation case at a fraction of the exposure.

The engineering translation is to ask what the system does with a field rather than whether it might one day be useful. A value read once at decision time and never referenced again does not need a column; a value kept for an investigation that has never happened is a liability carried against a hypothetical benefit, and it is carried for as long as the retention policy nobody revisits says so.

Retaining decisions rather than raw inputs usually satisfies the investigative case at a fraction of the exposure. A record that says which rule fired, on what evidence, at what time, with the identifying inputs stored as digests, answers the questions a dispute actually asks without reconstituting the personal data, which is the same structure an attestation provides.

Minimization also reduces work that has nothing to do with breaches. Every field of personal data retained is a field that must be found and produced for a subject access request, corrected when wrong, deleted on request, and disclosed to a counterparty performing diligence. Not collecting it removes all four obligations at once, which is why the principle is cheaper to apply at design time than to retrofit.

Storing a digest rather than a value is the usual mechanism, which makes keyed hashing the implementation of the principle rather than an alternative to it.