Purpose before collection
Data minimisation asks whether information is adequate, relevant and limited to what is needed for a defined purpose. In product design, start by naming the decision or service that requires a field. “It might help someday” is a weak basis for an expanding customer record.
Precision has a cost
More detailed information can increase exposure without improving the decision. Consider whether a coarse category, derived signal or shorter history answers the actual question. These alternatives still need appropriate governance; changing the format of personal information does not automatically remove all privacy obligations or risks.
A support example
A fictional support team needs to identify one payment. It can often start with an internal payment reference and limited matching details rather than asking a customer to email a full bank statement. If additional evidence becomes necessary, request the relevant portion through the approved secure process.
Review the lifecycle
Document who can access the information, why it remains necessary and when it should be reviewed or removed under the applicable policy. Include exported reports, logs and case attachments in that thinking. This practical exercise supports disciplined design; it does not determine the legal retention period for every organisation or dataset.