What is the data minimization principle?

• A. Collect as much data as possible for all uses.
• B. Retain data indefinitely to maximize future opportunities.
• C. Collect only the data necessary to fulfill a specific purpose and retain it only as long as needed.
• D. Share data with third parties to maximize use.

Answer: (C)

Data minimization means you collect only what you truly need to achieve a defined purpose and you keep that data only as long as necessary. This approach reduces privacy risk, makes compliance easier, and keeps data management simpler. The best option expresses this: gather just the data required for a specific purpose and retain it only as long as needed. For example, if you’re processing a single transaction, you might collect only what’s necessary for that payment and delete it after, rather than storing extra details forever. Collecting excessive data, keeping it indefinitely, or sharing it with others without a real need increases risk and goes beyond what this principle allows. If more data is later required for another purpose, it should be collected under a clear, justified need and with appropriate controls.