SECAI Core · phase 4 of 15
Data minimization
In data protection, the principle that only necessary and sufficient personal information can be collected and processed for the stated purpose.
The Explain card
- Plain English
- Data minimization is the data protection principle that you collect and process only the personal information that is necessary and sufficient for the stated purpose, and nothing extra.
- Example
- A support chatbot logs conversations for quality review. Minimization means stripping account numbers and addresses from those logs before they are stored or used for training.
- Why it matters
- Data a model never sees cannot be leaked, memorised or extracted. Minimization shrinks the blast radius of breaches and the legal exposure of training on personal data.
- Hook
- What you do not collect, you cannot lose.
Where it sits in the deck
Phase 4: Data Integrity, Governance, and Provenance
Once you know what data is, learn the principles that keep it trustworthy, traceable, and minimized throughout its lifecycle.
