It's not a matter of "if" but "when"

from here

Data Minimization: If you don't keep data you don't need, then that data can't be leaked when your security is breached