U.S. businesses have long operated on the premise of “the more data, the better.” The more data, the more information that can be leveraged for business use; the more data, the less need to explain missing data to courts and regulators.

While businesses that operate in the European Union under the General Data Protection Regulation (GDPR) or similar regimes have begun to come to terms with the concept of “data minimization,” U.S. companies have been slow to adopt data governance programs that include data minimization. As U.S. regulators begin to enforce the concept of data minimization as a core tenant in the protection of personal information, the age of unfettered data retention is quickly coming to an end.