Why collecting less data can improve business security

Organizations that collect and retain large amounts of personal data can create more opportunities for exposure, according to a TechRadar Pro Perspectives article by Ajay Patel, identified in the source as Head of World ID at Tools for Humanity (TFH). The article cites recent breaches and reported data sales as examples of the risks.

It says breaches at three major UK airports exposed information relating to nearly nine million people. Revolut mistakenly disclosed customer data to scammers impersonating government officials, while hackers reportedly offered scans of nearly 153 million US and Canadian driving licenses for sale on the dark web.

Identity checks can involve collecting names, birth dates, addresses, document scans and facial images, which may be stored or copied across suppliers and systems. The article argues that keeping more data creates more places where it could be exposed and used for fraud, impersonation or social engineering.

It proposes data minimization: services should request only what they need to verify at a given time. An age-gated service, for example, may need confirmation that someone meets a minimum age requirement, while a government service may need proof of residency. The article says these checks can be made without accessing or storing a person’s full dataset.

It also describes zero-knowledge cryptography as one possible approach. Digital credentials could be stored by individuals in an app, with proofs generated on their devices. A service could verify claims such as age, nationality or document ownership without receiving the underlying identity data. The article says zero-knowledge proofs are not a complete solution and presents them as part of a broader shift toward cryptographic verification.

Patel argues that retaining less reusable identity data could limit what attackers obtain in a breach, while helping organizations prepare for AI-related risks and possible future advances in decryption. The views are those of the author and are not necessarily those of TechRadar Pro or Future plc.