[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-data-minimization::en":3,"gloss-cluster-data-minimization::en":26,"gloss-next-data-minimization::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"data-minimization","security","Data Minimization","Data minimisation is the principle that you collect and keep only the personal data actually needed for a stated purpose, and no more. It is a legal requirement under GDPR-style regimes and, independently of that, the cheapest security control available, because data you never collected cannot be breached, subpoenaed, mishandled by a vendor, or turn up in a training set. The engineering translation is a set of concrete habits. Do not add a field to a form because it might be useful later. Store a derived value where the raw one is not needed — an age band rather than a birth date, a hash rather than an identifier, a country rather than a precise location. Set a retention period per data type at the point the table is designed rather than after an audit asks, and make deletion a scheduled job rather than an intention. Redact before logging: application logs, error trackers and analytics events are where personal data most often escapes a system whose primary database was carefully designed. And apply the same rule to third parties — every field forwarded to an analytics, support or model provider widens the boundary of what has to be disclosed and protected. Minimisation has a natural tension with product analytics and with AI features that benefit from more context, and the honest resolution is not to pretend otherwise but to make the trade-off explicit per field: what decision does this data support, who can see it, and when does it expire. Fields that cannot answer those three questions are the ones to drop.","Data minimisation keeps only the personal data a stated purpose needs — the engineering habits behind it, and why logs are where minimisation usually fails.",null,[11,14,17,20,23],{"slug":12,"name":13},"data-retention-policy","Data Retention Policy",{"slug":15,"name":16},"differential-privacy","Differential Privacy",{"slug":18,"name":19},"gdpr","GDPR (General Data Protection Regulation)",{"slug":21,"name":22},"pii","Personally Identifiable Information (PII)",{"slug":24,"name":25},"privacy-rules","Privacy Rules (Row-Level Security)",[27,31,35,39,42,45,48,51,54,57,60,63],{"slug":28,"category":5,"name":29,"updated_at":30},"audit-log","Audit Log (Audit Trail)","2026-08-24T02:46:37+00:00",{"slug":32,"category":5,"name":33,"updated_at":34},"blast-radius","Blast Radius","2026-08-24T03:30:02+00:00",{"slug":36,"category":5,"name":37,"updated_at":38},"break-glass-access","Break-Glass Access","2026-08-24T02:46:38+00:00",{"slug":40,"category":5,"name":41,"updated_at":38},"bridge-letter","Bridge Letter",{"slug":43,"category":5,"name":44,"updated_at":38},"business-associate-agreement","Business Associate Agreement (BAA)",{"slug":46,"category":5,"name":47,"updated_at":30},"byok","Bring Your Own Key (BYOK)",{"slug":49,"category":5,"name":50,"updated_at":38},"cve","CVE (Common Vulnerabilities and Exposures)",{"slug":52,"category":5,"name":53,"updated_at":34},"data-classification","Data Classification",{"slug":55,"category":5,"name":56,"updated_at":38},"data-loss-prevention","Data Loss Prevention (DLP)",{"slug":58,"category":5,"name":59,"updated_at":38},"data-poisoning","Data Poisoning",{"slug":61,"category":5,"name":62,"updated_at":38},"data-processing-agreement","Data Processing Agreement (DPA)",{"slug":64,"category":5,"name":13,"updated_at":30},"data-retention"]