Collect only what’s necessary
Every form field must serve a clear purpose. A date of birth “just in case” is a risk with no benefit.
Set a retention period
Data isn’t meant to stay forever. Deletion rules are decided during scoping and automated.
Limit access
The fewer people and services access the data, the lower the risk. AI tools are no exception, as our commitments point out. See also roles and permissions and our application security page.