Data Minimization

Data minimization starts with a specific purpose and asks what information is actually necessary to achieve it. For each field, document, event, or model input, engineers should justify its inclusion, required precision, recipients, and retention period. A delivery application may need an exact address to complete an order, while a demand-forecasting pipeline may need only a geographic region. Collecting the complete customer profile for both workloads creates exposure without necessarily improving either outcome.

Apply minimization at collection boundaries rather than relying entirely on cleanup afterward. Use explicit input schemas and field allowlists, reject unnecessary attributes, and avoid placing sensitive values in URLs, resource names, or diagnostic messages. In cloud pipelines, transform raw records into purpose-specific datasets before distributing them to analytics tools, development environments, or AI applications. Encryption and least-privilege access remain essential, but neither makes unnecessary collection acceptable: encrypted excess data is still excess data.

For generative AI, minimize the information sent to the foundation model, not just the information displayed in its answer. A support assistant might need the product, error code, and troubleshooting history but not the customer’s payment details. Redact those details before assembling the prompt, retrieve only relevant document passages, and avoid attaching entire conversation histories by default. Apply equivalent controls to tool responses, conversation memory, embeddings, caches, and inference logs. Embeddings should not automatically be treated as anonymous or harmless.

PII detection can identify candidate names, addresses, account details, and other sensitive content for removal or substitution. Amazon Comprehend can detect supported PII entities in supported text, while application logic can use the detected locations to redact or tokenize values. Amazon Bedrock Guardrails can block or mask supported sensitive information in configured input and output evaluations. These controls have coverage limits and can miss sensitive information, so validate them against representative examples and combine them with deterministic rules for known identifiers. Output filtering alone does not prevent sensitive input from reaching a model.

Choose transformations according to the task. Removing a name may preserve the usefulness of a complaint summary, while replacing repeated names with consistent placeholders may preserve relationships within a conversation. Tokenization and pseudonymization generally remain reversible or linkable and should not be described as anonymization. Even records without direct identifiers can sometimes be reidentified through combinations of location, dates, or rare attributes. Strong anonymization requires assessment of realistic linkage risks, not simply deleting a name column.

Minimization also requires lifecycle controls. Set retention periods for source records, derived datasets, prompts, outputs, and operational logs. Account for object versions, replicas, backups, and search indexes when implementing deletion. Deleting a training record does not automatically remove its influence from an already trained model; preventing unnecessary inclusion before training is usually more straightforward than remediation afterward.

The objective is necessary data, not the smallest dataset regardless of consequences. Excessive removal can reduce model utility, obscure explanations, weaken safety investigations, or prevent reliable fairness assessment. For example, deleting every protected attribute does not eliminate discrimination because other features may act as proxies, and it can make disparities harder to measure. Where justified and lawful, retain tightly controlled evaluation data separately from production inference inputs. Compare task accuracy, subgroup outcomes, explanation quality, privacy leakage, and behavior under malformed or adversarial inputs before and after minimization. Document the purpose, disclose relevant data practices, and assign ownership for exceptions and periodic review.