TechRadar Analysis: Less Data Retention Can Improve Business Security

In the UK, three major airports suffered data breaches that exposed information relating to nearly nine million people, according to the TechRadar article. In the fintech sector, Revolut mistakenly disclosed customer data to scammers impersonating government officials. In North America, hackers reportedly offered scans of nearly 153 million US and Canadian driving licenses for sale on the dark web.

The article says identity checks often involve collecting names, dates of birth, addresses, document scans and facial images, which are then stored and may be copied across suppliers and systems. That creates "honeypots" that attackers can target for fraud, impersonation and social engineering, it says. The more data an organization collects, the more places it creates exposure risks.

As data becomes more valuable, breaches become more lucrative for attackers and more damaging for businesses, according to the article. It warns that as AI tools become commoditized and easier to use, breaches may become more frequent unless organizations find ways to verify legitimate information without putting entire datasets at risk.

The article argues that verification does not require large amounts of data. Many free online services ask for more personal information than they need, and privacy-preserving authentication primitives can let people access content without revealing unnecessary details. For example, an age-gated service may only need proof that someone meets a minimum age, or a government service may only need confirmation of residency.

Data minimization can therefore serve as a security control and risk mitigation tool, the article says. The less information a service collects and retains, the smaller the attack surface. By asking only for what is needed at a particular moment, organizations can attest to what matters without creating an unnecessary, high-risk store of personal data.

The article points to modern zero-knowledge cryptography as a way to address the challenge. It says individuals could store digital credentials from chip-enabled ID cards or government digital identities such as mobile driver’s licenses in an app without making them accessible to third parties. They could then prove things like age, nationality and unique document ownership without revealing their identity or giving data to a third party.

When proof generation takes place on the individual’s device, sensitive information can remain local while the receiving service gets the proof it needs, according to the article. Holding less reusable identity data can limit what an attacker obtains if a service is breached.

The article also says reducing data retention will become more important as AI makes it harder to distinguish what is real and what data to trust. It notes that advances in computing power could mean private data encrypted today could be harvested and decrypted in a post-quantum future. Zero-knowledge proofs are not the finished article, it says, but should form part of a broader shift to cryptographic systems for verifying trusted information.