GDPR principle requiring collection of only the personal data necessary for specified purposes.
Data minimisation is a GDPR principle requiring that personal data collected be adequate, relevant, and limited to what is necessary for the purposes for which it's processed. Don't collect data 'just in case'—each data field should have a clear purpose. Minimisation reduces risk—data you don't have can't be breached. Review data collection practices to eliminate unnecessary fields and stop collecting data without clear purpose.
Why It Matters
The DSC Perspective:
Excessive data collection increases risk and compliance burden. Review what you actually need versus what you collect. Less data means less exposure if breaches occur.