Collect Less Than You Are Allowed To
Storage is cheap, so the default became keep everything. Every event. Every request body. Every version of every row, ten years deep, because deleting takes a decision and keeping takes none. That default is going to age badly. Data you hold is not an asset until somebody uses it. Until then it is stock, and stock carries a cost that arrives all at once. A breach does not care that the records…
The trend of storing all data, no matter how much, has become common. Every event, request body, and version of each row is kept indefinitely, often for ten years. However, this approach will become costly and problematic. Only data that is actively used holds value; the rest is simply stock that incurs costs without providing any benefit.
When a breach or subject access request occurs, it affects all copies, including those in analytics warehouses that may not have been mapped. Due diligence questions often reveal that companies do not know what data they possess or on what basis. As regulations become more specific, companies will need to provide detailed information on data retention, access, deletion, and proof of deletion.
To stay ahead, companies should assign retention periods to tables at the moment of creation and implement genuine deletion processes rather than hiding data with flags. Additionally, they should question the necessity of collecting new data before doing so. Companies that collect only what they use and delete the rest on a schedule will be better prepared for future challenges.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
