Why shouldn't we collect everything about everyone?

When a platform makes it technically easy to collect everything, the temptation is to do just that. Both the regulations and experience suggest otherwise.

The purpose must be determined first

The GDPR is based on you knowing why you are collecting something before you do so. “It may be useful later” is not a purpose. In practice, this means that every data source you connect should be justified by a specific question it is intended to answer.

Data you don’t use is pure risk

Data that sits unused provides no value, but must still be secured, handled in response to access requests, and deleted upon request. In the event of a breach, the impact is greater than it needed to be.

Less often leads to better analysis

Fifty fields with only twelve filled in lead to poorer decisions than twelve complete fields. Choose the information you actually use, and keep it up to date.

Plan for deletion at the same time

Decide how long each type of information should be retained when you connect the source. Deletion routines that are meant to be created later rarely are.