Data minimization asks whether each field, document, identifier, log, link, and retention period is actually needed. It favors narrow purpose, reduced precision, separation, local processing, short retention, and deletion when information no longer serves that purpose.
For AI services, minimization can keep identity evidence separate from prompts, allow anonymous access for low-risk uses, and use scoped proofs instead of complete documents. Collecting less reduces breach impact, tracking potential, compliance burden, and opportunities for later function creep.
ELI5
Data minimization means collecting and keeping only the information a service truly needs. Information that is never collected cannot later be leaked, misused, or linked with another record.
For example, a service that only needs to know whether a user meets an age requirement can store the verified result instead of retaining a complete identity document and birth date.
