Minimize client information
- Collect and retain only what the engagement requires.
- Redact, anonymize, or substitute representative information where practical.
- Keep each client’s files and working context appropriately separated.
- Never request passwords, authentication codes, full payment-card data, or unrelated private records.