Topic starter
11/07/2026 8:47 pm
TL;DR: Unstructured data, which makes up more than 80% of enterprise data, often becomes ROT within 90 days and expands breach exposure, according to OneTrust. The governance shift is from periodic cleanup to continuous policy enforcement across where data lives and how it is used, while cloud storage can cost $3,351 per terabyte per year and the average breach damage reached $4.4M in 2025.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “How OneTrust Helps Reduce Your Sensitive Data Footprint”.
By the numbers:
- Cloud storage alone accounts for 30% of a company’s overall IT budget, according to OneTrust.
- One terabyte of data costs $3,351 per year on average, according to OneTrust.
- The average damage of a data breach in 2025 sat at $4.4M, according to OneTrust.
Key questions
Q: What breaks when data minimization is not enforced as a security control?
A: When minimization is only a policy statement, sensitive content keeps accumulating in storage, collaboration tools, and backups.
Q: Why does excessive unstructured data increase security risk?
A: Unstructured data is hard to classify, hard to expire, and often spreads beyond tightly governed systems.
Q: What are the signs that data retention and minimization controls are not working as intended?
A: Common warning signs include redundant or obsolete data piling up, unclear retention periods, and sensitive records remaining in storage long after they should be deleted or archived.
Practitioner guidance
- Define retention boundaries by business purpose Map each major data workflow to the point where content stops being necessary and assign a retention rule to that trigger.
- Automate deletion, archiving, and de-identification Translate policy into system actions so stale files are removed or sanitised without relying on manual cleanup cycles.
- Discover where sensitive data actually lives Inventory cloud platforms, data stores, and collaboration tools to find unstructured repositories that sit outside normal governance.
Bottom line: Excess data is a security problem because it enlarges the exposed data estate, increases storage overhead, and keeps sensitive content available after it should have been retired.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:14 pm
Data minimization is now a security control, not a privacy afterthought. The article is right to frame retention as a control plane issue because the same content that creates compliance exposure also creates attacker reach. When organisations cannot prove why data still exists, they cannot credibly claim that access to it is proportionate. Practitioners should treat minimisation as part of attack surface management.
A few things that frame the scale:
- Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
A question worth separating out:
Q: How should security, privacy, and IAM teams share accountability for retention policy?
A: Security owns the risk reduction outcome, privacy defines the collection and retention purpose, and IAM governs who can still reach the data. If those functions operate separately, retention becomes a paper policy with no operational enforcement. The shared objective should be simple: keep only what the business can justify and control.
👉 Read our full editorial: Data minimization is becoming a security control, not just a privacy rule