What is data minimization?

Data minimization is the GDPR principle requiring organisations to limit personal data to what is relevant and necessary for a specific purpose. Each type of information collected should have a clear justification based on what the organisation is trying to achieve.

For example, a basic email newsletter generally needs an email address. Requesting a home address or date of birth would require an additional, specific justification.

Organisations can apply this principle by removing unnecessary form fields, reducing the detail collected by tracking tools and using anonymous information where it can achieve the intended purpose. Privacy by design helps incorporate these considerations when a website, product or process is first developed.