Have you ever saved a customer spreadsheet just in case you needed it again? Maybe you’ve kept copies of old employee records, downloaded an entire database when you only needed a few entries, or held onto documents from a project that ended months ago.
Most of us have done something similar. After all, keeping extra information might seem harmless. What if you need it again someday?
Unfortunately, every unnecessary piece of sensitive information creates another opportunity for that information to fall into the wrong hands.
That’s why data minimization is such an important part of cyber-compliance. A recent federal enforcement action shows what can happen when organizations hold onto information long after they need it.
What Is Data Minimization?
Data minimization is the practice of collecting, using, sharing, and retaining only the information necessary for a legitimate purpose.
For example, suppose you’re organizing a customer appreciation event. You probably need attendees’ names and contact information. Do you also need their birth dates, account numbers, financial records, or Social Security numbers, though? Of course not!
Collecting unnecessary information creates additional privacy risks without providing any real benefit.
The same principle applies to information you already have. If your organization no longer needs certain records, and no legal or business requirement says they must be retained, keeping them indefinitely can become a serious compliance problem.
Case Study: Illuminate Education
In June 2026, the Federal Trade Commission (FTC) finalized an order against education technology company Illuminate Education following a major data breach. An attacker accessed personal information belonging to approximately 10.1M students in late 2021 and early 2022.
The compromised information included names, addresses, dates of birth, student records, and health-related information.
The attacker reportedly used credentials belonging to a former employee who had left the company years earlier.
Unfortunately, that wasn’t the only problem. Illuminate allegedly failed to establish reasonable data retention practices, leaving it with large amounts of information that should no longer have been stored. In some cases, the company reportedly retained student records from school districts it hadn’t worked with for nearly a decade.
Think about that for a moment. Information belonging to students from years earlier remained accessible long enough to become part of a much larger security incident.
The FTC required Illuminate to delete unnecessary personal information, limit future collection and retention, and establish a publicly available data retention schedule. Still, this case study goes to show: Information you no longer need can still create serious risks.
Mistake #1: Collecting Information You Don’t Need
Sometimes we request information simply because it’s included on a form. Maybe you’re registering a customer for a service and the form asks for several personal details that aren’t actually necessary.
Before requesting sensitive information, ask yourself: Do I really need this to complete the task?
If the answer is no, then follow your organization’s procedures for limiting unnecessary collection.
Remember that collecting less information means having less information to protect, too.
Mistake #2: Sharing Entire Files Instead of Specific Information
Suppose your coworker needs the phone number of one customer. Instead of sending that information, you forward an entire spreadsheet containing hundreds of customer records. It’s certainly convenient, but you’ve exposed far more information than necessary.
Instead, share only the relevant information using an approved method. This is especially important when handling Personally Identifiable Information (PII), Protected Health Information (PHI), or financial records.
Just because someone is authorized to receive some information doesn’t mean they need access to everything.
Mistake #3: Keeping Unnecessary Copies
Downloading a document can seem like a harmless part of your workday. Unfortunately, those single instances can accumulate quickly.
You might have customer spreadsheets sitting in your Downloads folder, old reports saved to your desktop, or copies of confidential documents stored in multiple locations. Each unnecessary copy creates another place where sensitive information needs extra protection.
Use approved storage locations, avoid making unnecessary copies, and follow your organization’s retention and secure-deletion procedures.
Don’t independently delete records that must be preserved for legal, regulatory, or business reasons. When you’re unsure whether you should retain a certain file, ask your supervisor or compliance team first.
How Can You Practice Data Minimization?
Fortunately, you don’t need to manage an entire database to make a difference. Start by paying attention to the information you handle every day.
- Collect only what’s necessary. Don’t request additional personal information without a legitimate reason.
- Limit what you share. Give recipients only the records or details they actually need.
- Avoid unnecessary copies. Keep sensitive information in approved systems rather than scattering it across devices.
- Follow retention policies. Don’t keep records indefinitely or delete them without authorization.
- Ask when you’re unsure. Your compliance or IT team can help determine how information should be handled.
Most importantly, remember that having access to information doesn’t automatically mean you should collect, copy, or share it.
Conclusion
The Illuminate Education case demonstrates an important lesson about protecting sensitive information: Cybersecurity isn’t always about adding more protections around the information we store. Sometimes, it’s about recognizing which information we shouldn’t be keeping in the first place.
Before collecting, saving, or sharing sensitive information, ask yourself three simple questions:
- Do I need this information?
- Does the recipient need all of it?
- Am I following the rules for how long it should be kept?
You can’t expose information you never collected, and properly deleting information you no longer need can reduce the damage of a future breach. Sometimes, less data really does mean better security!
