I find the idea of not storing sensitive data unless it's absolutely necessary particularly interesting.
It's a very good one.
Unfortunately it's often an uphill batle to get acceptance for not storing a lot of 'nice to have' data that's not really neccesary to keep and that greatly increase the complexity of the application.
Beeing able to conjure som estimates on the cost (not just economic) of adding each table/field sell better with management than just complaining though. Remember to apply π2 to your first idea when you think of a number. Add prime time news headlines to the picture when it's security related.