More collection does not always improve understanding. Unnecessary data increase protection burdens and risks without helping the task.
The decision to examine
Define purpose, necessary fields, access, retention and deletion. Use synthetic training examples: changing a name alone does not anonymise a personal record.
Worked example
For a hypothetical complaint-summary exercise, we need problem type and requested action, not identity numbers, phones or addresses. Remove these fields before using the example.
From idea to practice
- Describe the problem as a need, not a product name.
- Specify evidence needed before a decision and who reviews it.
- Test a non-personal example and log failures as well as successes.
- State whether to continue, improve or stop and why.
Your exercise
Take a blank form and list its fields. Explain why each is necessary and remove those whose need you cannot justify.
Review rubric
A useful answer identifies a context, checkable evidence, a boundary and an owner for the next step. If it fits any organisation unchanged, add a detail specific to the case. This is a learning rubric, not automatic marking or official assessment.
Further reading: AI Risk Management Framework — NIST · 2023; page reviewed 2026 · Checked: 8 October 2026
Your next step
Open the readiness notebook · Explore policy sources
Institutional DJAIRI material prepared with AI assistance. Learning examples are hypothetical; analysis and recommendations are Mustanef’s. Citing a source does not imply partnership or endorsement.