An agent assists with employee onboarding. During a session, it learns the employee's name, job title, start date, department, manager name, and salary band. The agent is designed to support this employee in future sessions as well. Applying strict data minimization principles, which data should be retained in long-term memory for future sessions?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Data minimization is like packing for a trip — only take what you'll actually need, not everything in your closet. Option C is correct: job title and department are stable attributes the agent needs to tailor content, while everything else is either retrievable on demand, a one-time fact, or too sensitive to store. Never put salary in long-term memory.
Full explanation below image
Full Explanation
The correct answer is C. Data minimization — a foundational principle in frameworks like GDPR and NIST Privacy Framework — requires retaining only data that is necessary for the stated purpose and no longer than that purpose requires. Applied to this scenario:
Job title and department are durable facts the agent needs to customize onboarding content in future sessions (e.g., routing an engineer to engineering-specific resources vs. a sales hire to CRM training). These are appropriate to retain.
Name can be retrieved from the HR system directory at session start — it is not a fact the agent uniquely possesses, and retrieving it on demand avoids creating a duplicate personal data store. Manager name falls into the same category.
Start date is a one-time onboarding milestone. Once onboarding is complete, the start date has no ongoing utility in the memory store and should not be retained.
Salary band is sensitive financial data subject to strict access controls. Storing it in a general-purpose agent memory store violates least-privilege principles and creates unnecessary exposure risk.
Option A is wrong because blanket retention of all session data violates data minimization. Maximizing personalization is not a legitimate basis for retaining every piece of employee data collected.
Option B is wrong because it treats salary as the only sensitive field. Name, manager, and start date all carry privacy implications and should either be excluded or retrieved on demand rather than persisted.
Option D is wrong because it swings too far in the other direction. Retrieving all context fresh each session increases latency, API dependency, and system complexity without a proportionate privacy benefit. Retaining non-sensitive utility data like job title and department is entirely appropriate.