---
title: "Keep only what you need and delete it on · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/privacy/data-minimization
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep only what you need and delete it on time

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Privacy](https://agentwranglers.se/playbook/website/privacy)
- Rule: Collect only the data a task needs. Keep it only for its set retention period, and delete it on schedule and on request.
- How: List each field you collect and why, and drop the rest. Keep access and debug logs without IP addresses or query strings. Default formats, such as nginx's `combined`, log both. Dynamic IP addresses are personal data, as the EU Court of Justice held in Breyer (C-582/14). Where a law or a payment dispute needs one, keep it in that record only. Give that record its own purpose and period in the [retention schedule](https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule). Fraud evidence for a card payment keeps the address for about 18 months, which covers 365 days plus the dispute window. Tax evidence stores the country, not the address. An audit event stores a shortened address or a place. Delete records automatically after a fixed time, and delete on request. Keep passwords and tokens out of logs too, as in [keep private data out of logs](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/private-data-out-of-logs).
- Check: A test stores a record older than its retention period, runs the scheduled delete job, and the record is gone. A search of a day's access log finds no IP address.

Example:

```nginx
# Access log without IP addresses
log_format noip '$time_iso8601 "$request_method $uri" $status $body_bytes_sent';
access_log /var/log/nginx/access.log noip;
```

```sh
# crontab: every night at 03:00, delete enquiries older than 12 months
0 3 * * * sqlite3 /var/lib/app/data.db "DELETE FROM enquiries WHERE created_at < date('now', '-12 months')"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/privacy/data-minimization`.

- Previous: [Count visits without tracking people](https://agentwranglers.se/playbook/website/privacy/analytics-privacy)
- Next: [Store each preference where it is needed](https://agentwranglers.se/playbook/website/privacy/preference-storage)
- [Privacy](https://agentwranglers.se/playbook/website/privacy)