Data minimization is becoming a security control, not just a privacy rule

At a glance

What this is: This is a data governance analysis showing that minimization and retention have become security controls because excessive unstructured data increases cost, risk, and breach exposure.

Why it matters: It matters to IAM, NHI, and broader security teams because retention policy, data visibility, and enforcement now shape how much sensitive material attackers can reach.

By the numbers:

• Cloud storage alone accounts for 30% of a company’s overall IT budget, according to OneTrust.
• One terabyte of data costs $3,351 per year on average, according to OneTrust.
• The average damage of a data breach in 2025 sat at $4.4M, according to OneTrust.
• More than 80% of the data stored by organizations is unstructured, according to OneTrust.

Context

Data minimization is the discipline of limiting collection, retention, and reuse to what is genuinely needed for an explicit purpose. In practice, security teams care because excess data expands the attack surface, complicates governance, and increases the amount of sensitive material that must be controlled across cloud storage, collaboration tools, and downstream analytics.

The article’s core argument is that retention policy is no longer only a privacy obligation. Where organisations can discover, classify, and enforce data use continuously, they reduce exposure for human identity data, workflow data, and the unstructured content that often sits outside tighter IAM and NHI controls.

For security programmes, the key change is from periodic cleanup to policy enforcement at the point data is created and stored. That is a broader governance shift than a single privacy task, and it is now a practical control problem rather than an abstract compliance principle.

Key questions

Q: What breaks when data minimization is not enforced as a security control?

A: When minimization is only a policy statement, sensitive content keeps accumulating in storage, collaboration tools, and backups. That increases breach exposure, makes access governance harder, and leaves obsolete data available long after its business purpose has ended. The practical failure is that organisations cannot reduce risk if they do not reduce the amount of data attackers can reach.

Q: Why does excessive unstructured data increase security risk?

A: Unstructured data is hard to classify, hard to expire, and often spreads beyond tightly governed systems. That means more content remains available to users, service accounts, and attackers than the business actually needs. The result is a larger attack surface, more over-sharing, and a weaker ability to prove that access is still justified.

Q: What are the signs that data retention and minimization controls are not working as intended?

A: Common warning signs include redundant or obsolete data piling up, unclear retention periods, and sensitive records remaining in storage long after they should be deleted or archived. Another signal is inconsistent classification across systems, which makes it difficult to know which data is truly subject to regulation. When that happens, both attack surface and compliance exposure grow.

Q: How should security, privacy, and IAM teams share accountability for retention policy?

A: Security owns the risk reduction outcome, privacy defines the collection and retention purpose, and IAM governs who can still reach the data. If those functions operate separately, retention becomes a paper policy with no operational enforcement. The shared objective should be simple: keep only what the business can justify and control.

Technical breakdown

Why unstructured data becomes a control problem

Unstructured data includes emails, attachments, images, PDFs, and similar content that does not sit in neatly governed database fields. Because it spreads across collaboration platforms, cloud stores, and ad hoc workspaces, it often escapes the same policy enforcement used for structured records. Once that data becomes redundant or obsolete, it still remains searchable, shareable, and exfiltratable. The result is a governance gap: organisations know the data exists, but they do not know when it should stop being retained or where every copy lives.

Practical implication: treat unstructured content as governed security data, not leftover business material.

How retention policy becomes an enforceable control

A retention policy only changes risk when it is translated into automation. That means defining when data stops being necessary, mapping that condition to deletion, archiving, anonymisation, or de-identification, and then enforcing the rule where the data resides. This is where data governance intersects IAM and NHI practice: systems, service accounts, and users all touch the same content, so policy has to work across access paths rather than only in a privacy register. Without orchestration, policy remains advisory and attackers inherit the sprawl.

Practical implication: connect retention rules to the systems that store and move data, not to a document library.

Why continuous discovery matters for attack surface reduction

Continuous discovery is the mechanism that keeps minimisation current as data changes. Static inventories age quickly because access patterns, file locations, and business use all drift over time. The article’s point is that organisations need visibility into sensitivity, context, and intended use so they can flag over-retention, over-sharing, and data that no longer serves a business purpose. In security terms, this is blast-radius reduction: less retained data means less material available to misuse if an account, workflow, or repository is exposed.

Practical implication: monitor data use continuously so retention exceptions do not quietly become permanent.

Threat narrative

Attacker objective: The attacker aims to reach sensitive, long-retained content that should already have been deleted, minimised, or de-identified.

1. Entry occurs when sensitive content is collected broadly and stored without a clear retention boundary, creating large pools of accessible unstructured data.
2. Credential or account misuse then exposes files, attachments, and collaboration data that were never meant to remain live for long periods.
3. The impact is expanded breach exposure and regulatory risk because obsolete data still sits in systems attackers can reach.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data minimization is now a security control, not a privacy afterthought. The article is right to frame retention as a control plane issue because the same content that creates compliance exposure also creates attacker reach. When organisations cannot prove why data still exists, they cannot credibly claim that access to it is proportionate. Practitioners should treat minimisation as part of attack surface management.

Unstructured data is the governance gap most programmes still under-measure. Structured datasets are easier to classify, but emails, PDFs, and attachments become the hidden majority of risk because they live across collaboration and storage platforms. That creates an operational mismatch between policy intent and actual data location. The practical conclusion is that discovery and policy enforcement must extend beyond the records team into security operations.

Retention failure creates a form of data sprawl that weakens identity controls downstream. Even strong IAM and PAM leave too much residual risk if users and service accounts continue to hold access to content that should no longer exist. This is the named concept: retention-driven attack surface sprawl. Security teams should measure how much sensitive data can be deleted, not just how much can be accessed.

Centralised governance is only useful when it is operationalised at the point of use. The article’s strongest point is that classification, retention rules, and enforcement need to move together across cloud platforms and collaboration tools. That aligns with NIST-CSF governance and data protection outcomes, but the operational test is whether policy actually changes storage behaviour. Practitioners should focus on enforcement fidelity, not policy volume.

AI-ready data foundations depend on minimised, trusted data sets. The article implicitly connects data reduction with future AI use because uncontrolled data estates are difficult to secure, explain, or govern. That matters for AI governance, identity governance, and data security alike, since over-retained data increases the chance that sensitive patterns are reused in unintended ways. Security leaders should align minimisation with AI readiness from the start.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: AI Infrastructure Workload Identity Guide

What this signals

Retention-driven attack surface sprawl: the real security issue is not simply storing too much data, but allowing obsolete data to remain accessible across systems that no longer need it. That shifts minimisation from a records-management concern to a control for reducing exposure across cloud platforms and collaboration tools.

Security teams should align retention enforcement with identity governance so access reviews, deletion rules, and classification outputs point at the same data estate. When 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, the broader lesson is that policy intent still outruns operational enforcement, according to the 2026 Infrastructure Identity Survey.

The data minimisation discussion also matters because AI programmes inherit the same storage and reuse habits as traditional data estates. If organisations cannot govern what should remain in the data estate, they will struggle to prove that downstream AI use is operating on authorised, minimised inputs.

For practitioners

• Define retention boundaries by business purpose Map each major data workflow to the point where content stops being necessary and assign a retention rule to that trigger.
• Automate deletion, archiving, and de-identification Translate policy into system actions so stale files are removed or sanitised without relying on manual cleanup cycles.
• Discover where sensitive data actually lives Inventory cloud platforms, data stores, and collaboration tools to find unstructured repositories that sit outside normal governance.
• Monitor for over-sharing and retention violations Set alerts for data that remains accessible after its business purpose has expired, especially in shared workspaces and file stores.
• Tie minimisation to AI governance and access reviews Use retention and classification outputs to inform who should still have access and whether the dataset should be reused for AI or removed.

Key takeaways

• Excess data is a security problem because it enlarges the exposed data estate, increases storage overhead, and keeps sensitive content available after it should have been retired.
• The operational failure is not just collection volume but weak enforcement, especially for unstructured content that escapes normal governance workflows.
• Security teams need retention rules that are translated into automated deletion, archiving, and classification-aware controls across the systems where data lives.

Key terms

• Data Minimization: Data minimization is the practice of limiting personal data collection to what is adequate, relevant, and necessary for a specific purpose. It reduces exposure by shrinking what is gathered, transferred, retained, and processed. Strong minimization depends on careful form design, purpose review, and strict collection discipline.
• Data Retention: Data retention is the practice of keeping records for a defined period to satisfy legal, regulatory, audit, or business requirements. In security programmes, retention should be tied to data class and purpose, because keeping information longer than necessary increases storage cost, discovery burden, and exposure if the data is later compromised.
• Unstructured Data Environment: An unstructured data environment is the collection of files, documents, shares, and content repositories that do not fit neatly into relational systems. These environments are difficult to govern because sensitive information can spread across many locations, making discovery, classification, access control, and remediation more complex.
• Attack Surface Management: Attack surface management is the practice of finding and evaluating assets that could be exposed to misuse or compromise. CAASM focuses on internal visibility across the environment, while EASM focuses on externally reachable assets. It is a discovery discipline, not a complete identity control model.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course covers NHI governance, human identity, and secrets management, with a practical focus on how identity controls support wider security programmes. It is suitable for practitioners who need to connect access governance to data, platform, and operational risk.