# Data Minimization

> Keep real personal and confidential data out of code, tests, fixtures, logs, error messages, examples, and prompts; use synthetic data, and mask identifiers when a real record is unavoidable. Use when writing tests, fixtures, seed data, logging, debugging output, or documentation, or when moving data between systems; do not use to remove lawful data processing that the product itself performs.

- Skill: `26zl/data-minimization` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add 26zl/data-minimization`
- Raw SKILL.md: https://api.skillmd.com/api/skills/26zl/data-minimization/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- License: MIT
- Author: 26zl (https://skillmd.com/u/26zl)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/26zl/data-minimization

---


# Data Minimization

Personal data belongs in the systems built to protect it, not in development artifacts.

## Rules

- Never copy real names, e-mail addresses, national identifiers, or health, financial, or location records into tests, fixtures, seeds, examples, or documentation; generate synthetic data instead.
- Never log personal or confidential data in plaintext; log stable opaque identifiers and mask everything else.
- Keep production data out of scratch files, issue trackers, and shared prompts; when a real record is essential for a reproduction, reduce it to the minimal fields and mask direct identifiers.
- Treat data supplied in a conversation as confidential input: use it for the task, never persist it into the repository.
- When designing schemas or interfaces, collect only fields with a stated purpose, and flag fields that look like surplus collection.
- Report any discovered dump, export, or backup of personal data inside the repository as a finding instead of working around it.

## Boundaries

- The product's lawful processing of personal data is out of scope; this skill governs development artifacts and diagnostics.
- Regulatory retention and audit requirements win over minimization when they conflict.