Data minimisation is the principle most often agreed with and least often applied. Personal data must be adequate, relevant and limited to what is necessary for the purpose. Every word cuts both ways: too much is an infringement, but so is too little to do the job properly.
Three questions for every field
- Is it needed for the purpose we stated? If the honest answer is “it might be useful later”, it is not needed now.
- Is it needed in this form? A date of birth when an age band would do, a full address when a postcode district would, a name when a reference number would.
- Is it needed by everyone who can see it? Minimisation applies to access as well as collection.
Where data accumulates
| Source | What to do |
|---|---|
| Free-text fields | Replace with structured options where possible; they collect special category dataSpecial category dataHealth, genetic and biometric data, racial or ethnic origin, political opinions, beliefs, trade union membership, sex life and sexual orientation. Processing needs an Art 9 condition as well as a lawful basis. by accident |
| Optional fields that are never used | Remove them from the form |
| Copies for testing | Use synthetic or masked data, not production extracts |
| Logs and analytics | Truncate IPs, pseudonymise identifiers, set short retention |
| Email and shared drives | Retention rules and periodic clean-ups |
| “Just in case” exports | Ban them, or log and expire them |
Minimisation and retention
Keeping data longer than necessary is the time dimension of the same failure. A retention schedule is minimisation applied to time. Data you no longer hold cannot be breached, requested or wrongly relied on.
Minimisation and security
Minimisation is a security control. The 2022 ransomware attack behind the first UK processorProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. penalty, and the PSNI disclosure of every officer’s name in an FOI spreadsheet, were both made worse by data that did not need to be where it was.
Minimisation and AI
Training data is not exempt. A model trained on more personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. than its purpose needs breaches the principle, and the data may be recoverable from the model. Prefer aggregated, synthetic or pseudonymised training data where it meets the purpose.
Evidence
The record of processing should show the data categories for each purpose, and a DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people. should show that you considered less intrusive alternatives. That is how you demonstrate minimisation, not by asserting it.