Do not even collect all data that you once believed you needed, but periodically question your "needs".

The only secure data is that which was never collected in the first place.

I've been terminally online since the 90s and if you google my real name, you'll get nothing. I'm a ghost, and this is wise advice.

_{I member...}

Where I work, customers are asked for their name, address, and email address to send the books and invoices. For phone number in case something is urgent. That's it. It's stored in a modest, local database that only contains that, and that isn't connected to other databases, applications, or even the outside world. It has always been like this. There is zero, absolutely zero interest in checking people and storing information. There are better and more positive things to do

"collect everything and invest massively in tech that allows us to collect even more"?

I have collected
the data
that I did
not need

and which
you were probably
saving
for breakfast

Step 4: ensure that the data is accurate and, where necessary, up to date:

Principle (d): Accuracy

(ico.org.uk)

Step 5: don't process the data in ways that are incompatible with your original reason for collecting it:

Principle (b): Purpose limitation

(ico.org.uk)

Rather in regulations.

Data that is not needed shall not be collected.

12 step programs for data addicts

Both cheaper and easier.