Only data necessary for the stated purpose is collected; no excessive fields

GDPR Art. 5(1)(c) and Art. 25 (privacy by design) require that only data strictly necessary for the stated purpose is collected. Collecting a phone number on a SaaS tool with no SMS or calling feature, or a date of birth on a product with no age gate, is not a grey area — it is excess collection with no lawful purpose. This creates real risk: every field you collect is a field that can be breached, subpoenaed, or scraped. Excess collection also signals to regulators that data minimization was never considered, which compounds penalties for other violations. AI-built apps are particularly prone to schema bloat because code generators default to comprehensive field lists rather than minimal ones.

Audit every form and database schema column together. For each personal data field, ask: which specific feature breaks if this field is removed? If nothing breaks, remove it from both the form and the schema.

// BEFORE — over-collection at signup
type SignupForm = {
  email: string      // needed
  password: string   // needed
  phone: string      // not used anywhere — remove
  birthdate: string  // no age gate — remove
  gender: string     // no personalization — remove
}

// AFTER — minimal compliant collection
type SignupForm = {
  email: string
  password: string
  displayName?: string  // optional; only if shown in UI
}

For the database, run SELECT column_name FROM information_schema.columns WHERE table_name = 'users' and cross-reference against actual application queries. Drop columns that are never read. Delay collection of additional fields until the feature that requires them actually ships.