Data Minimization in Practice

The data minimization principle requires organizations to collect only the personal data that is necessary for a clearly defined purpose (GDPR Article 5(1)(c)).

Organizations often collect data for legitimate reasons, such as analysis, accountability, or security, which can create the assumption that more data means better oversight. However, the European Union Agency for Cybersecurity (ENISA) and the European Data Protection Board (EDPB) note that collecting more than is necessary increases security risks, governance complexity, and the likelihood of unintended reuse.

The practical question is: how can an organization determine what data it actually needs?

What Data Minimization Means

Data minimization means collecting only the data directly needed to achieve a specific, clearly defined purpose. Organizations should know why each data point is collected, how it will be used, and how long it needs to be kept.

Over-collection creates tangible risks:

Greater breach impact. Larger datasets are harder to secure and cause more harm if compromised.
Function creep. Data may later be used for purposes other than those it was collected for, contrary to the purpose limitation principle (Article 5(1)(b)).
Heavier compliance burden. Retaining unnecessary data increases obligations and complicates governance.

Why Over-Collection Happens

Over-collection is rarely deliberate. It usually results from operational habits:

"Collect now, decide later." Gathering extra data in case it becomes useful conflicts with the requirement to tie collection to a defined purpose.
Unclear purposes across teams. Without a shared understanding of purpose, different departments add data fields to meet immediate needs.
Concern about future analysis. This often leads to retaining data that is rarely, if ever, used.
External pressures. Audits and reporting obligations can encourage keeping data "just in case" rather than for an active need.

How to Determine What Data Is Necessary

Data minimization starts before any data is collected. Three simple checks help:

Purpose specification. Write a concise purpose statement that is specific enough to justify each data element.
Data mapping. Identify what data is collected, where it is stored, and how it is used across systems. This reveals redundancies and data held without a clear purpose.
The "Would it still work without it?" test. For each data element, ask whether the processing would still function without it. If the answer is yes, the data is unlikely to be necessary. For example, an online learning platform needs a unique user identifier to record a learner's progress, but detailed socio-economic background is not needed to deliver a course unless it is required for a clearly defined purpose.

Keeping Data Minimal Throughout Its Lifecycle

Deciding what to collect is only the first step. Data should remain limited and relevant for as long as it is held:

Anonymize or de-identify data where possible. Where full anonymization is not feasible, reducing the use of direct identifiers still lowers risk.
Set and enforce retention periods, in line with the storage limitation principle. Data should be kept only as long as it serves its original purpose.
Review and clean up regularly. Systems accumulate unused or redundant data over time, which should be securely deleted.
Treat minimization as ongoing, not a one-time decision, so that data stays aligned with its purpose as systems and requirements change.

Data Minimization as an Enabler

Data minimization is often seen as a restriction, but it supports more effective data management:

lower exposure to security risks and breaches,
reduced storage and compliance costs,
simpler governance, since each data element has a clear purpose, use, and retention period, supporting GDPR accountability, and
greater trust from the people whose data is processed.

Conclusion

Data minimization is achieved through a series of deliberate choices made before and during processing. Defining purposes, mapping data flows, and testing whether each data element is truly needed determine what to collect. Retention limits, anonymization, and regular reviews keep that data relevant and proportionate over time.