Data minimization: Policy and requirements
Every persisted, indexed, logged, exported, and backed-up field declares an adopter-defined purpose, retention class, and lawful basis reference without claiming legal approval, and collection rejects undeclared fields at write time across storage surfaces.
Package status: AI-assisted reference package. Static package validation has passed; implementation scenarios remain not run and human domain review is required before stable adoption.
Decision
Data minimization is enforced through a field inventory listing every allowed field with purpose_code, retention_class, lawful_basis_ref, surface flags, and derived_surfaces lineage. Writers validate payloads against the inventory at ingress. lawful_basis_ref is required on every inventory field and points to adopter-defined policy documents, not legal conclusions by this block.
Scope
- Field inventory maintenance, write-time validation, index mappings, structured log transforms, export allowlists, and backup scope declarations.
- Derived surface lineage and transform rules for indexes and logs.
Outside this block
- Legal interpretation of GDPR, CPRA, or other regulations; adopters map obligations to purpose codes themselves.
- Encryption at rest and key management.
- User-facing consent banners and preference centers.
Contract
- Any field persisted to primary storage must exist in field-inventory.yaml with purpose_code, retention_class, and lawful_basis_ref when lawful_basis_ref_required is true.
- Write APIs reject payloads containing fields not listed in the inventory when strict_mode is enabled in the profile.
- Search indexes may contain only fields explicitly marked indexed true; reindex jobs fail if mappings introduce undeclared fields or transforms that differ from derived_surfaces.
- Structured application logs may emit only fields with loggable true; others must be redacted or hashed per inventory log_transform rules.
- Support exports and backup schemas include only fields marked exportable or backup respectively.
- Retention class drives automated deletion or anonymization jobs; fields without retention class fail inventory validation at commit time.
- Removing a field from inventory triggers a profile-defined deprecation window after which writes and exports fail closed for that field.
Implementation guidance
- Generate inventory checks into CI from the YAML source; diff inventory on every pull request touching schemas.
- Map ORM or schema migrations to inventory updates in the same change request.
- Use transform hints such as hash or truncate-to-date for log-only derivatives rather than copying raw sensitive fields.
- Document lawful basis refs as opaque ids resolving to internal policy wiki pages maintained by the adopter.
Failure handling and safeguards
- Inventory parser errors block deploy rather than running without validation.
- Emergency field addition requires inventory update in the same release artifact; hotfix without inventory update is rejected when emergency_bypass_disabled is true.
- Audit job reports drift when live database columns exceed inventory entries.
Verification and operations
- Tests attempt writes with undeclared fields and fields missing lawful_basis_ref and expect rejection.
- Sampling compares export files to inventory allowlists monthly.
- Metrics track inventory drift findings and deprecation window violations.
Adoption assumptions
- Names and numeric values in example.yaml and field-inventory.yaml are an adoption profile, not universal defaults.
- The adopting team owns purpose taxonomies and lawful basis references without this block asserting compliance approval.