What this control covers
Limit collection to minimum relevant, proportional and necessary data. Implementation: Implement data minimization policies, defaults, and technical configurations. Justification: Minimization reduces risk and compliance burden.
Why it matters
Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.
How to implement
AWS
Default to SSE-KMS with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use S3 Bucket Keys and S3 Block Public Access at the account level, and turn on S3 Object Lock on backup buckets for ransomware resilience.
Azure
Store secrets in Key Vault (HSM-backed where required) with soft-delete + purge protection; use customer-managed keys for Storage, SQL, and Azure Disk Encryption. Tag PII data via Microsoft Purview.
GCP
Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.
Google Workspace
Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.
GitHub
Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.
On-premises
Operate a Records of Processing Activity (RoPA) and a data-subject-request (DSR) workflow with named owners, SLA per regulation (GDPR 30 days, DPDP 30 days, CCPA 45 days). iCompaas users can track requests + evidence inside the Privacy module.
Evidence to collect
policy_document— A signed, version-controlled policy stating leadership intent and the named owner.
Signed policies, procedures, and registers document the safeguard. Focus: Limit collection.
Quick checklist
- Implement — Limit Collection
- Limit — Limit Collection
- Collect — Limit Collection
Related articles on this site
- Ensure Implement Scanning to Detect and Prevent Sensitive Data in Deployment Configurations
- Data Privacy Regulations
- NIST 800-171 3.3.9 Limit management of audit logging functionality to a subset of privileged users.
- NIST 800-171 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.