I'm doing a backup of a 2GB SD card (and its partition table, etc.) which contains 500 MB (1.5 GB unused) with
dd if=/dev/sdX | gzip > my_image.gz
It will backup the 500 MB of useful data but also potentially:
some random data (harmless),
zero data (harmless),
or even personal data that was previously on the SD card in the "unused space" bytes, if the SD card was not previously erased with dd if=/dev/zero .... Isn't this is a potential data leak?
1) So is it safe to backup a SD card with dd that way? (considered that some previously-deleted-personal-data might be saved in the backup!)
2) Is there a way to "zero" all the unused space of the SD card before dding?
Yes it will work and yes, as you say, if you have any hidden, old data there, it will be stored in your image as well. So if you are worried about not storing those files, just use tar.
If you want to zero unused space you can use zerofree, check this thread: https://unix.stackexchange.com/questions/44234/clear-unused-space-with-zeros-ext3-ext4 (assuming you're using ext3 or ext4).
Honestly, no idea how to do it with fat (which is what you're likely using if it's an sd), maybe the only way would be to tar everything, dd it to zero, and untar...
To recover that back-up you should dd it back to an SD that is at least as big as that one (if it's bigger, it will waste some space as the partition will be just 2Gb, but it will still work).
As I said in my comment, using dd is good when you need to preserve everything, such as boot sectors and partition configuration. If you don't have any of that, and you want to save the files there, use good ol' tar.