Why this matters
LGPD requires data minimization and purpose limitation.
Collect only strictly necessary fields for the declared purpose; mark optional PII as nullable and omit from payloads when empty. Fail requests that include undeclared extra PII keys.
LGPD requires data minimization and purpose limitation.
Side-by-side examples engineers can pattern-match during review.
{ name, email, phone, mother_name, birth_city }{ name, email } // phone optional and excluded if empty\nvalidateKeys(input, allowed=["name","email","phone?"])validateKeys(body, ["name","email","phone?"])save(req.body) // accepts extra PIIFrom the same buckets as this rule.