Data minimization

Data minimization mandates that data controllers collect only the personal data that is adequate, relevant, and limited to what is necessary for the purposes for which they are processed. The principle stems from the idea that less data means less risk: if a breach occurs, the harm is contained because the attacker obtains fewer or less sensitive fields. It also aligns with the concept of privacy by design, encouraging organizations to embed minimization into system architecture rather than retroactively reducing data.¹ In practice, minimization can be achieved through techniques such as pseudonymization, aggregation, and selective collection (e.g., asking for only the last four digits of a credit card instead of the full number).

The GDPR enshrines data minimization in Article 5(1)(c) and further specifies it in Articles 6 (lawfulness of processing), 25 (data protection by design and default), and 89 (safeguards for archiving, research, and statistics). The California Consumer Privacy Act (CCPA) and Brazil’s Lei Geral de Proteção de Dados (LGPD) contain similar provisions. Enforcement actions include fines for excessive collection: for example, in 2023 a German regulator fined a company €5.1 million for requesting users’ dates of birth when only age verification was needed. The UK’s Information Commissioner’s Office (ICO) has published guidance emphasizing that data minimization is not a one-time check but a continuous process requiring periodic review of data retention and necessity.

Organizations can implement data minimization through several technical and organizational measures. Data masking replaces sensitive values with obfuscated equivalents, while tokenization substitutes a token for a real value, storing the mapping separately. Attribute-based access control (ABAC) ensures that only necessary attributes are exposed. In analytics, differential privacy adds noise to query results, allowing useful insights without precise personal data. The privacy by design framework (developed by Ann Cavoukian) includes data minimization as one of its foundational principles.¹ Another approach is data retention schedules: automatically deleting or anonymizing data after a defined period reduces the volume of stored personal data.

Data minimization is sometimes misunderstood as requiring only the collection of the absolute minimum possible, but the GDPR allows proportionality: what is necessary depends on the purpose and context. A lesser-known edge case is the purpose limitation interplay: minimization can be violated even if the amount of data is small, if the data is not relevant to the purpose. Another nuance is that minimization applies to third-party data sharing: controllers must ensure that recipients also receive only necessary data. In the medical field, minimization is balanced against the need for data for research, leading to legislative exceptions (e.g., GDPR Article 89).² The concept also appears in the context of data portability: when exercising the right to port data, an organization may need to filter out information that is not the user’s own data (e.g., metadata about others).

Data controller

The entity that determines the purposes and means of processing personal data.

Pseudonymization

The processing of personal data so that it can no longer be attributed to a specific data subject without additional information.

Privacy by design

An approach to systems engineering that incorporates privacy protections from the outset.