Which practice minimizes the data exposed in a breach by design?

• A. Data minimization: Collect and retain only what is necessary.
• B. Store all data indefinitely for forensics.
• C. Mirror all user activity to every server.
• D. Disable encryption to speed up access.

Answer: (A)

Data minimization is about collecting and keeping only what is strictly necessary for the purpose at hand. In a breach, the amount of data that an attacker can access is tied to how much data you have stored. By limiting what you collect and how long you keep it, you reduce the attack surface and the potential impact of any breach. Fewer records, fewer fields, and shorter retention windows mean less data can be exfiltrated, and the organization can respond faster because there’s less to manage and secure.

Implementing this approach involves evaluating every data collection point to ensure only essential information is gathered, applying strict retention policies, and using techniques like anonymization or pseudonymization when possible to further minimize the value of the data being stored. Encryption remains important, but its benefits are maximized when there’s simply less data to protect.

Storing data indefinitely increases the volume of information available to a breach, making damage more likely. Duplicating or mirroring data across all servers creates more copies that could be exposed. Even though encryption is critical, turning it off would dramatically raise risk and undermine security. Data minimization directly reduces what could be exposed by design, making it the most effective practice in this context.