Start with purpose and authority
Data minimization is not merely deleting columns after ingestion. The team should identify the exact process decision, the information needed to perform and evaluate it, the source owner, permitted use, affected population, retention rule, and whether a less sensitive representation can meet the requirement.
A minimum-necessary sequence
- Define the workflow and the claim or action the data will support.
- Inventory candidate sources and identify authority, ownership, classification, effective dates, and access rules.
- Exclude fields and records that do not contribute to the approved purpose or evaluation.
- Apply authorization before retrieval; do not rely on a prompt to hide inaccessible content.
- Mask, tokenize, aggregate, or pseudonymize where clear text is unnecessary.
- Set retention and deletion for prompts, outputs, traces, caches, indexes, and evaluation corpora—not only source records.
- Test for leakage, cross-tenant exposure, stale entitlements, and unauthorized citation links.
Data rights and data quality are different gates
A clean, complete dataset may still be unusable because the organization lacks authority for the intended purpose. A lawful dataset may still be unfit because it is incomplete, stale, unrepresentative, or unable to establish ground truth. Both gates must pass independently.
Protect derivative data
| Derivative | Why it matters |
|---|---|
| Prompts and conversations | May combine identifiers, sensitive questions, or excerpts that are more revealing than any single source. |
| Embeddings and indexes | Can retain recoverable semantic information and must inherit access, deletion, and tenant controls. |
| Evaluation sets | May contain rare, difficult, adverse, or high-value cases and require restricted reuse. |
| Telemetry and traces | Can expose user intent, source names, model output, tool parameters, costs, and security events. |
| Cached answers | Can survive source correction, access revocation, or supersession unless invalidated. |
Decision conditions
- No source owner or permitted-use decision means no production ingestion.
- No reliable authorization model means use search or a segregated offline assessment instead of generated answers.
- No deletion or revocation propagation means the service is not ready for sources whose rights or content can change.
- No representative evaluation data means uncertainty must remain visible and the pilot scope must shrink.
