Totally. Companies often collect way more info than necessary during KYC, and when breaches happen, that extra data becomes a ticking time bomb. If they only took what they actually needed, the damage would usually be a lot smaller.