Privacy

The Best Way to Protect Sensitive Data Is Not to Have It

The safest data is the data you never collected. The next safest is data you hold in a form you can't read. Most breaches expose information a company had no real reason to keep. Here's the privacy-by-design idea behind that, in plain terms.

Every piece of sensitive data you hold is a small liability. Store a client's passport scan, a password, or an ID number, and you're now responsible for keeping it safe, one mistake away from it becoming someone else's problem. The safest version of that data is the version you never collected. The next safest is data you hold in a form you can't actually read.

Every extra thing you keep is one more thing that can leak. Some of the data caught up in a breach is data the business was holding but no longer needed.

You can't lose what you don't have

A shop that empties its till every night can't be robbed of its cash at 3am. There's nothing there to take. Data works the same way. The records you don't collect, and the copies you delete when you're done, can't show up in a breach, an accidental email, or a legal request.

This flips the usual security question. We tend to ask "how do we protect all this data?" The sharper question is "why do we have all this data in the first place?"

Collect less than you think you need

Start with the form itself. For each field, ask what decision actually depends on it. A lot of collection is habit, not need:

• You ask for a full date of birth when all you need to know is that someone is over 18.
• You ask for a whole document when a single page would do.
• You keep a copy "just in case", and the just-in-case copy is the one that leaks.

Collecting less does something no security tool can: it shrinks the amount of data that can ever go wrong. That's why data minimisation sits at the heart of both privacy law and good security.

Hold what you must in a form you can't read

Some data you genuinely have to receive. You can still avoid keeping it in readable form. With client-side encryption, information is scrambled on the sender's device before it reaches you, and the key stays with the people who should see it, never on the server. You end up holding a locked box you can't open yourself. If someone breaks in, or a court comes asking, there's nothing readable to hand over.

Then let it go properly when the work is finished. Done right, deletion destroys the key, so every copy, backups included, becomes unreadable at once.

Privacy by design, in one sentence

Privacy by design gets talked about as a compliance checkbox. In practice it's simpler: hold less, hold it blind, and let it go when you're done. The strongest data-protection control isn't a bigger lock. It's not having the data.

Where doconvoy fits

doconvoy is built around this idea. A request collects only the fields you specify, each submission is encrypted in the sender's browser so we only ever store a version we can't read, and every request carries an expiry date by design. You get what you need, in a form no one else can open, and it doesn't linger once the job is done.

Related: GDPR-sensitive data workflows · How doconvoy's encryption works · Is it safe to send passwords over email or Slack?

Common questions

What is data minimisation?

Collecting only the personal data you actually need for a specific purpose, and nothing more. It's one of the core GDPR principles (Article 5), and it doubles as a security control: data you never collected can't be stolen, leaked, or subpoenaed.

How can a company hold data it can't read?

With client-side (end-to-end) encryption. The data is scrambled on the sender's device before it's uploaded, and the key never reaches the company's servers. The company stores only the scrambled version, so a breach or a legal request turns up nothing readable. This is often called zero-knowledge.

Isn't some data collection unavoidable?

Yes. You'll always need to collect something. The point is to collect the least you can, hold it in a form you can't read where possible, and delete it properly once the job is done.