.png){kind=logo}
Introduction
Data Minimisation is a core principle in privacy and security frameworks that states you should only collect, retain, and process data that is necessary, and delete it when it is no longer needed.
It is explicitly advocated by several major frameworks and regulations:
Regulatory / Legal
-
GDPR (Article 5(1)(e)) — "Storage Limitation" principle: personal data must not be kept longer than necessary for its purpose
-
PDPA (Singapore) — the Retention Limitation Obligation requires organisations to cease retaining data when it is no longer needed for any business or legal purpose
-
HIPAA — requires covered entities to dispose of protected health information when no longer needed
Security Frameworks
-
NIST SP 800-53 — includes data retention and disposal controls (MP-6: Media Sanitisation)
-
ISO/IEC 27001 — A.8.3 (Media Handling) and A.11.2.7 (Secure Disposal) address deletion of data no longer required
-
CIS Controls — Control 3 (Data Protection) explicitly includes secure disposal of data
Core Principle
The underlying rationale is simple: you cannot leak data you no longer have.
Reducing your data footprint directly reduces your attack surface.
Why data minimisation matters
In service desk platforms such as Jira Service Management, data tends to accumulate quietly over time. Customers upload screenshots, screen recordings and log files which they did not redact or mask out important information like
-
Login IDs
-
IP addresses
-
email addresses
-
passwords or credentials
-
and other PII
Personally Identifiable Information (PII) refers to any data that can be used to identify a specific individual, either on its own or when combined with other information. Examples include names, phone numbers, identification numbers, and any other data points that can reasonably be linked back to a person.
This creates several practical risks:
-
Compliance exposure — obsolete attachments may contain personal data, confidential records, or regulated information that should no longer be retained.
-
Security risk — every unnecessary file is another potential source of leakage if permissions are misconfigured or an account is compromised.
-
Storage growth — unused attachments consume storage and make administration harder.
Also, checking for PIIs in attachments is very difficult especially when there are many attachments. Manually opening each file to verify whether it contains sensitive information is time-consuming, inconsistent, and easy to overlook. Even with automated PII scanning tools, it still requires manual review to check against false positives.
How Attachment Housekeeper helps
Attachment Housekeeper supports data minimisation by helping administrators by housekeeping attachments when they are no longer needed. Instead of relying on manual checks, it provides a safe and automated way to clean up unnecessary files.
It can help organisations:
-
Reduce retained data by removing files that may no longer serve a business purpose.
-
Support retention policies by making it easier to act on rules such as deleting files after a defined period or after a project has ended.
-
Lower security exposure by reducing the amount of sensitive or stale information stored in Confluence.
Why not just delete the Jira requests?
Sometimes it is not viable to delete the Jira issues. They are required for
-
reporting and data analysis
-
billing and recovery
-
audit requirements
Practical outcome
By regularly removing unnecessary attachments, organisations can turn data minimisation from a policy statement into an operational practice. Attachment Housekeeper helps make this repeatable in a safe manner before it becomes a compliance, security, or storage problem.