Data Minimisation as a Design Principle for Legal Tech

The cheapest way to reduce breach exposure is not to hold the data. For legal technology, where the data is by definition sensitive, this is a design constraint rather than a policy aspiration.

What minimisation means in a document platform

Not deleting things aggressively — documents under review must remain available. It means being deliberate about what is created beyond the document itself: extracted text, embeddings, search indices, cached renderings, log entries, analytics events, support-tool copies. Each derived artefact is a second copy of the sensitive material, frequently in a system with weaker controls than the primary store.

Four practices that work

Derive on demand where feasible. A cached rendering that can be regenerated in 200 milliseconds does not need to be stored for six months.

Scope logs to identifiers. Application logs should record that document 4f21 was processed, not what it said. This is the most common source of unintended document content in low-security systems.

Make deletion cascade. Deleting a document should delete its extracted text, embeddings, index entries, thumbnails and derived findings. A deletion that leaves the vector index populated is not a deletion, and it is the failure most often discovered during an audit rather than during design.

Bound support access. Engineers debugging a customer issue should not require a copy of the customer’s document. Reproduction with synthetic material, redaction-by-default tooling, and time-limited approved access with an audit record are the alternatives.

Retention as a technical control

Retention policies enforced by a person reviewing a spreadsheet quarterly do not survive contact with reality. Retention should be a property of the record, enforced by a scheduled job, with the deletion recorded. Then the policy question becomes what the period should be, rather than whether the period is observed.

The commercial argument

Every security questionnaire asks what you store, where and for how long. Short, accurate answers shorten procurement. Long, qualified answers extend it — and the qualification is usually somebody’s honest description of a derived artefact nobody planned for.