Which security control is most appropriate for the Data collection stage in a secure ML lifecycle?

• A. Authentication and access control
• B. Data augmentation
• C. Data minimization and consent
• D. Full dataset encryption

Answer: (C)

In the data collection phase, the most effective control is to minimize what you collect and obtain clear consent for processing. Data minimization reduces the amount of personal or sensitive information entering the ML pipeline, which lowers exposure risk and eases privacy compliance. Coupled with consent, it ensures that data collection aligns with legal and ethical standards, supporting transparent and responsible use of data from the outset.

Authentication and access control, while essential for protecting data later in the lifecycle, doesn’t directly address how much data is gathered or whether you have consent at the moment of collection. Data augmentation is a modelling/prep technique and not a security control for collection. Full dataset encryption protects data at rest or in transit, but it doesn’t prevent over-collection or establish consent at the collection point.