Data Minimization

Explanation

Data minimization checks that an AI system uses only the data fields it genuinely needs rather than every field available, reducing privacy exposure if the system is compromised — a core principle for a fraud-detection model that should not ingest a customer's entire profile when a handful of signals suffice. It matters immediately under RBI Safety/Resilience, NIST MANAGE 3.1 and ISO Clause 6.1.2, since collecting and processing surplus personal data increases both regulatory and breach risk. It is measured by the Minimization Score = 1 - (Used_Fields / Available_Fields) for fraud detection systems — the closer to 1, the smaller the share of available fields actually consumed. To implement, instrument the feature/data layer (Document Extraction and RAG flows) to inventory every field available to the system and track which fields are actually used by the model, compute the ratio, and log the used-versus-available field sets as evidence so reviewers can justify each field against its purpose. The threshold is a Minimization Score above 0.6, meaning the system uses fewer than 40% of available fields; scoring at or below 0.6 is a breach signalling over-collection, which triggers a field-by-field necessity review and removal of fields that cannot be justified before the system continues operating.