Data minimisation and purpose
Services should collect and retain information for a clear reason. Data flows, access, retention and deletion are considered during design rather than left to a policy that does not match the implementation. The practical test is whether leaders, users and delivery teams can understand the decision, see who owns it and continue operating the result after the immediate work has finished.
