Encrypted communication still produces metadata such as time, participants, device state or delivery events. Minimisation begins by asking whether a field is needed and how coarse it can be while serving its purpose.
Other controls include short retention, pseudonymisation, context separation and restricted queries. Transparent deletion periods matter as much as technical restraint.
Three verification questions
- 01Is every field tied to a necessary purpose?
- 02Can precision or retention be reduced?
- 03Who can link records across contexts?