What does data minimisation mean under GDPR?
Definition
Data minimisation is the GDPR principle that an organisation may collect and keep only personal data that is adequate, relevant and limited to what it needs for its stated purpose, and no more.
- Category
- Privacy
- Also called
- data minimization, minimisation principle
- Last updated
Data minimisation is one of the principles in Article 5 of the GDPR. The text says personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". The UK GDPR uses the same wording, and the ICO breaks it into three tests: the data must be sufficient to do the job, have a rational link to the purpose, and not go beyond what you need.
The principle starts with the purpose. A company has to know why it wants your data before it collects it, because "adequate" and "necessary" only mean something against a purpose. The ICO says the UK GDPR doesn't define those terms, so the answer can differ from one case to the next.
A concrete example
The ICO gives one: a recruitment agency sends every applicant a questionnaire that includes health questions relevant only to some manual jobs. Asking someone who applies for an office job about their health is irrelevant and excessive. The agency should ask those questions only of the people they apply to.
The ICO is just as clear that holding too little can also be a problem. If the data can't properly do the job it was collected for, it is inadequate.
Why it matters to you
Every extra detail a company keeps is one more thing that can leak in a breach or be sold on. A shop that only needs your delivery address has no good reason to keep your date of birth. The ICO also says that holding more data than you need is likely to be unlawful, and that people have a right to ask for unnecessary data to be deleted under the right to erasure.
Data minimisation vs. related principles
- Purpose limitation says why data may be used. Minimisation says how much of it.
- Storage limitation says how long data may be kept. Minimisation says what is kept at all. The ICO notes the two are closely linked: organisations should review what they hold and delete what they no longer need.
- Accuracy says the data must be correct. The ICO calls these three, with minimisation, the principles about data standards.
How to protect yourself
- 1
Give only what a form needs
If a sign-up asks for a phone number or birth date it has no obvious need for, leave optional fields empty or ask why it's needed. Data minimisation is the company's duty, but you can apply it from your side too.
- 2
Ask a company to delete what it doesn't need
Under the UK and EU GDPR you can ask an organisation to erase personal data that isn't necessary for its purpose. A data subject access request shows you first what they hold.
- 3
Delete old accounts
Accounts you no longer use keep your details on file. Close them, and ask for the data to be erased, rather than just ignoring the emails.
- 4
Cut down what brokers hold
Data brokers collect far more than they need. Serus finds where your address and phone number are listed and removes them, and keeps checking so they don't reappear.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Which article of the GDPR covers data minimisation?
Article 5(1)(c). The UK GDPR has the same principle, and the ICO's guidance explains it as "Principle (c): Data minimisation".
Does data minimisation mean companies can't collect any data?
No. They can collect what they need for a clear, stated purpose. The principle is about not collecting or keeping more than that.
What happens if a company holds more data than it needs?
The ICO says that is likely to be unlawful and a breach of the principle, and that individuals have the right to ask for it to be erased. Whether a specific case breaks the law is for the regulator or a lawyer to say.
Is it data minimisation or data minimization?
Both spellings are used. Minimisation is the British spelling used in the ICO's guidance.
Sources
Something wrong or out of date? Tell us and we'll re-check it.