Data minimization can be difficult, but it’s necessary to remain in compliance with security and privacy laws.