data-minimizationlisted

# Data Minimization Field-level privacy audit for data schemas, API payloads, event structures, database models, and pipelines. Identifies excess collection, retention, and exposure — then recommends the least-invasive remediation for each violation. **Composable with:** - `redact` — strip actual PII values from sample data before analysis - `threat-model-privacy` — establish what adversary can do with minimized data residual - `opsec-review` — audit schemas before committing to public repos --- ## Scope Handles any data structure type: | Input type | Analysis focus | |---|---| | JSON / YAML schema | Field necessity, type precision, nullability | | API request / response | Exposure surface, over-fetching, response bloat | | Database model / ERD | Normalization, retention, separation of concerns | | Event / log format | Temporal retention, identifier persistence, aggregation opportunities | | OCSF / SIEM schema | Class mapping, field inheritance, observable minimization | | On-chain data structure | Permanent immutability risk, public ledger exposure | | Data pipeline / ETL | Transformation points where minimization can be applied | Declare input type at start of analysis or infer from content. --- ## Regulatory Source of Truth Statutory citations and jurisdiction facts (deadlines, thresholds, category lists, penalty ceilings) in this skill and its reference files derive from the normalized taxonomy: `taxonomy/regulatory-taxonomy.md` + the per-jurisdiction records (`