Data Minimisation

Review status: This foundation page requires specialist review before public approval. Its claims must remain within the scope stated here.

Data minimisation means collecting, disclosing, processing, and retaining only the evidence needed for a defined purpose. It is not simply deleting data later. The principle must shape the credential schema, verifier request, presentation, decision record, and retention policy from the beginning.

UbID supports a transition from document collection to proof-based verification. Instead of routinely receiving the complete underlying document, a verifier can evaluate a signed claim or derived statement that answers its policy question.

From documents to claims

Traditional remote identity processes often request a scan, photograph, or PDF even when only one fact is relevant. This can expose names, identifiers, addresses, dates, photographs, document numbers, and other information unrelated to the transaction.

A minimised approach separates three layers:

1. Source evidence — the original document, record, or institutional process used by the issuer.
2. Credential claims — the facts the issuer is authorized to certify.
3. Presentation — the subset or derived proof disclosed to a particular verifier.

The verifier receives the evidence required for its decision without automatically receiving every fact known to the issuer or held by the wallet.

Examples of proportionate evidence

Trust question	Potentially proportionate evidence	Usually unnecessary by default
Is the person above an age threshold?	Boolean or threshold proof	Exact birth date and full identity document
Is a professional authorization active?	Qualification, issuer, scope, and current status	Complete education and employment history
May this person represent an organization?	Role, organization, authority scope, and validity	Unrelated personal profile information
Is residency in an eligible jurisdiction confirmed?	Jurisdiction or eligibility result	Full address history and source documents
Has an approved verification process been completed?	Assurance result and date range	Raw biometric or document-capture data

These examples are conceptual. Sector rules may require additional evidence or records.

Minimised credential design

A credential schema should contain claims that are:

• necessary for the credential's stated purpose;
• understandable to holders and verifiers;
• issued by an authority competent to make them;
• separated from unrelated internal data;
• versioned and governed through a lifecycle;
• suitable for selective presentation where supported.

Adding fields "for future use" increases privacy risk and makes later purpose limitation more difficult.

Minimised verification requests

A verifier request should identify:

• the relying party;
• the declared purpose;
• the credential or assurance category;
• the minimum required claims;
• freshness and status expectations;
• whether holder binding is required;
• the intended audience and transaction context.

The request should not reveal or infer the complete contents of the holder's wallet.

Minimised evidence receipts

Accountability does not require storing every disclosed credential. A verification receipt can record selected evidence such as:

• transaction and policy references;
• requesting and responding participants;
• credential type and issuer reference;
• claims requested and disclosed;
• status and verification outcome;
• timestamps, challenge references, and decision result;
• the policy version used.

Secret material, undisclosed claims, complete wallet inventories, raw biometrics, and recovery secrets should not appear in ordinary operational evidence.

Retention is a separate decision

Minimisation does not mean that all evidence disappears immediately. Some institutions have legal, audit, safety, or dispute-resolution obligations. The appropriate retention period depends on purpose, jurisdiction, sector, participant role, and risk.

The institution should distinguish:

• transient challenges and session data;
• verification receipts;
• credentials held by the person;
• source documents retained by an issuer;
• operational security records;
• legally mandated records.

Each class requires its own access, retention, deletion, and review rule.

Limits of selective disclosure

Selective disclosure reduces unnecessary exposure, but it is not a complete privacy solution. Correlation can still arise from stable identifiers, network metadata, repeated claim combinations, verifier behavior, or external datasets.

Privacy therefore also requires scoped identifiers, controlled logging, purpose enforcement, retention limits, user transparency, and governance of secondary use.

Related pages

See Privacy by Design, Verification and Policy, and Credential Lifecycle.