Collecting and keeping only the data actually needed for the task at hand — less data held means less data at risk.