CRISC and privacy frameworks such as ISO/IEC 27701 and GDPR emphasize data minimization as the first step in managing privacy risk:
"Personal data collection must be limited to what is necessary for the specified purpose." If data is never collected, there's no need for storage, encryption, or training around it - thus reducing exposure and risk at the source.
Other options, while useful, come after minimizing collection:
* A and D address residual risk.
* B (normalization) affects data structure, not privacy risk reduction.
Hence, C. Minimize the collection of data is correct.
CRISC Reference: Domain 3 - Risk Response and Mitigation, Topic: Privacy Risk Controls.