Which statement about data minimization is most accurate?

• A. Data minimization allows unlimited data collection for future opportunities.
• B. Data minimization requires data to be stored indefinitely to meet compliance.
• C. Data minimization permits sharing data with third parties regardless of consent.
• D. Data minimization requires collecting only the data necessary for the purpose and retaining it only as long as needed.

Answer: (D)

Data minimization means collecting only what’s needed to achieve a specific purpose and keeping that data only as long as it’s needed. This reduces privacy risk, makes data governance easier, and helps with compliance by limiting both what you store and for how long. To apply it, you define the purpose, identify the minimum data elements required to accomplish it, and set retention periods that require deletion or anonymization once the data is no longer needed. For example, in a customer support process you might collect an email and the issue details, but you wouldn’t gather extra personal data unless it’s essential to resolve the request. It also guides data sharing—only share what’s necessary to achieve the purpose and with appropriate consent or a lawful basis. Statements that imply unlimited data collection, indefinite storage, or sharing without regard to necessity don’t align with this approach.