Ask how a platform protects sensitive data and you will hear about encryption, access control and audit logging. All necessary, all expensive, all applied to a dataset nobody questioned.
The question that comes earlier is which of it needs to be there at all.
Where fields come from
Almost no field is added maliciously. They arrive through reasonable-sounding routes:
- Someone might need it. No identified use, no owner, collected anyway.
- The old form had it, so the new form has it.
- It makes a report easier, though the report could be built from something less sensitive.
- Full precision by default. A date of birth captured where an age band would do, an address where a postcode district would do.
Each is defensible individually. Together they produce a record far more sensitive than the service requires, and every control afterwards has to cover all of it.
What minimisation actually buys
It is not only a legal position, though it is that. It is operational:
Less to secure. Controls cost the same whether the field is used or not.
Smaller breach. The severity of an incident is set by what was in the record, which was decided at design time.
Shorter subject access. Every field is a field to find, explain and export.
Easier retention. Data you did not collect never needs a deletion rule.
Faster assurance. DPIAs and supplier reviews go quickly when the answer to “why do you hold this” is short.
The questions worth asking per field
For each item on a form:
- What decision does this change? If none, it is storage, not information.
- Could a less precise version do? Age band rather than date of birth, area rather than address, a flag rather than a note.
- Is it needed now, or being collected against a future feature? Future features can collect their own data.
- Who needs to see it? A field only two roles need should not be on a shared screen.
- How long is it useful for? If the answer is weeks, it should not be kept for years.
Free-text is where it accumulates
The field that causes the most trouble is usually a notes box. It exists because structured capture never covers everything, and it fills with exactly the information you were careful not to ask for — medical details, family circumstances, third-party names.
It cannot be minimised away, because it is genuinely useful. It can be scoped: narrow it to a purpose, label it plainly, restrict who sees it, and give it a shorter retention than the record it hangs off.
Where we have applied this
We build platforms holding data about children, where consent, retention, role-based visibility and audit trails are part of the design rather than a later conversation — The Performance Centre being the clearest example. The most useful sessions on that work were the ones that removed fields.
Those meetings feel unproductive. They are the cheapest security work available.
Reviewing what your platform actually needs to hold? Get in touch, or read about our health and life sciences work.