Lion Cipher Lab
Audit a system's personal data fields against actual use for data minimisation
- GRC / Compliance
- Intermediate
- ~35 min
- Free · no account required
Why it matters
GDPR Article 5(1)(c) says personal data must be 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed'. That is data minimisation, and the UK regulator's guidance makes the practical point: you should identify the minimum personal data you need for your purpose, hold that much and no more, and review periodically. Every form field that is collected and never used is pure liability: it can be breached, must be included in access requests, and needs a retention rule. Teams rarely check, because collecting is easy and removing feels risky.…
What you'll learn
- what GDPR data minimisation requires
- comparing collected fields with declared purposes
- using access logs to find fields nobody reads
- spotting purpose creep from who reads a field
- the difference between collecting and storing
- turning findings into a minimisation plan
Steps in this lab
- Necessary for a stated purpose, and no more
- The fields and 90 days of usage
- Write the minimisation audit
- Run it: three unused, two creeping
- Make it a periodic review