Data Minimisation
Art. 5(1)(c) GDPR — only what is necessary
TL;DR
Data minimisation is one of the six GDPR principles (Art. 5(1)(c)). Personal data may only be processed where it is adequate, relevant and limited to what is necessary for the purpose.
What is data minimisation?
Practical examples of data minimisation breaches:
- Asking for a date of birth on newsletter sign-up — not necessary
- A full postal address for the purely online delivery of digital products
- A copy of an identity card for a standard job advertisement
Practical example
Online shop: an address is needed for shipping. For a newsletter sign-up, an email address is enough. A telephone number is not required. If the shop makes the telephone number a mandatory field on newsletter sign-up — that is a breach of data minimisation.
Frequently asked questions
How does data minimisation differ from storage limitation?
Data minimisation = which data. Storage limitation = for how long. Both are in Art. 5.
Fines for a breach?
Art. 83(5)(a) — up to EUR 20 million or 4% of worldwide group turnover.
Can I extend the data collected later?
Only with a new legal basis and information provided to the data subjects.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.