Application collects only necessary data; no PII beyond what's required

GDPR Art. 5(1)(c) (data minimization) and Art. 25 (data protection by design) require that only data strictly necessary for the stated purpose is collected. AI-built apps routinely over-collect: a SaaS tool adds a phone number field because the template had one, or an onboarding flow asks for date of birth with no age-gating logic behind it. Every unnecessary field increases breach impact — a database dump containing phone numbers for a tool that never uses them exposes data that should never have existed. CCPA §1798.100(a) also restricts collection to what is disclosed and necessary. ISO-27001:2022 A.5.34 requires minimization as part of privacy-by-design controls.

Audit every form and database column by asking: what feature breaks if this field is removed? Remove fields where the answer is "nothing," and defer optional fields until the feature that needs them actually ships.

// BEFORE — over-collection
type SignupForm = {
  email: string      // needed
  password: string   // needed
  phone: string      // no SMS feature — remove
  birthdate: string  // no age gate — remove
  gender: string     // no personalization — remove
}

// AFTER — minimal
type SignupForm = {
  email: string
  password: string
  referralSource?: string  // optional, aggregated only
}

Run SELECT column_name FROM information_schema.columns WHERE table_name = 'users' and cross-reference each column against the code that reads it. Columns that are populated but never queried are candidates for removal.