Data minimization and storage limitation are the paired privacy duties that tell an organization to collect only the personal data a stated purpose requires and to keep it only as long as that purpose survives. This guide traces the duties from their roots in the Fair Information Practice Principles and the OECD Guidelines through GDPR Article 5, the CCPA as reworked by the CPRA, the FTC's unfairness enforcement under Section 5, and sectoral commands in the GLBA Safeguards Rule, HIPAA, the FCRA, COPPA, and Illinois's BIPA. It quantifies the four costs of hoarding—breach amplification, standalone regulatory exposure, the discovery tax, and operational rot—and then lays out a seven-part operating program covering data mapping, classification, retention scheduling, deletion that reaches every copy, de-identification to the correct legal standard, privacy by design, and governance. Invented worked examples and a detailed FAQ turn doctrine into decisions a business can act on. The unifying idea is that the data you never collected and the data you lawfully destroyed cannot be breached, subpoenaed, sold, or fined.