Breach severity is determined largely by decisions made long before the incident: what was collected, and how long it was kept. Organisations routinely discover that the most damaging records in a breach were ones nobody had a current use for.
Collect less at the point of capture
Review every form and integration and ask what each field is actually used for. Date of birth collected for no reason, full identity documents retained after verification, complete card details stored when a token would suffice. If no current process consumes a field, stop collecting it — that decision has no downside and compounds over time.
Set and enforce retention
Retention policies that exist only in a document are not retention policies. Automate deletion: scheduled jobs, storage lifecycle rules, database routines. Where a legal obligation requires keeping something, keep that specific thing for that specific period rather than keeping everything indefinitely because one category needs it.
The places data actually accumulates
- One-off CSV exports sitting in cloud drives and personal folders.
- Backups with no expiry, containing data deleted from production years ago.
- Staging and development environments seeded with real production data.
- Email attachments — spreadsheets of customer records forwarded and never removed.
- Analytics and log data containing identifiers nobody intended to retain.
Non-production environments are the common gap
Real customer data in a staging environment inherits none of production's controls and is frequently accessible to contractors and third-party tools. Use synthetic or masked data. If that is genuinely impractical, apply production-grade controls to the environment and say so explicitly in your risk documentation.
The benefits compound
Less data means smaller breach impact, narrower notification obligations, cheaper storage, simpler subject access requests, and less to audit. It is one of the few security measures that reduces cost and workload rather than adding to both.