Data Minimisation Under GDPR: Article 5(1)(c), Retention, and Penalties

Under the General Data Protection Regulation, data minimisation means collecting and keeping only the personal data that is adequate, relevant, and limited to what is necessary for the purpose you’ve identified. The rule sits in Article 5(1)(c), and it applies to every organisation processing personal data of people in the EU, wherever that organisation is based.¹ Article 5(2) puts the burden on you, as controller, to demonstrate you’re following it. Getting it wrong can trigger fines of up to €20 million or 4% of global annual turnover, and individuals can sue for compensation on top.

The Three-Part Test in Article 5(1)(c)

Personal data must be adequate, relevant, and limited. Each word does independent work.

Adequate means you hold enough information to actually achieve your stated purpose. Too little data can be as problematic as too much if it leads to inaccurate outcomes. Relevant means every data point has a clear connection to the purpose you disclosed. Limited to what is necessary means you collect the minimum required to fulfil that purpose, and nothing more.²

The old approach of hoarding data on the chance it might be useful later fails this test. So does claiming your collection is proportionate without being able to show it. Under Article 5(2), you need to be able to prove compliance, not just assert it.¹

The scope is broader than most people assume. Personal data under Article 4 covers any information relating to an identifiable person: names, ID numbers, location data, and online identifiers such as IP addresses, device IDs, and cookie data.³ Minimisation applies to all of it.

Minimisation also runs in parallel with the requirement to have a lawful basis for processing under Article 6.⁴ Having consent does not entitle you to collect all data; minimisation still limits you to what is necessary for the purpose covered by that consent.

What Minimisation Looks Like in Practice

Applying the test means examining every field you collect. A customer signing up for an email newsletter typically needs to give a name and email address. Asking for a home address or government ID for a newsletter fails the relevance test because neither has any connection to sending emails. A date of birth is defensible for an age-restricted service and indefensible for a standard retail purchase where age plays no role.

The ICO’s guidance is direct: identify the minimum amount of personal data needed to fulfil your stated purpose and hold only that amount. Data should not be collected “on the off-chance” it might prove useful later.²

Do this before any form, app screen, or collection mechanism goes live. Every input field should map to a documented purpose. If you cannot articulate why a specific field exists, it should not be there.

Building Minimisation Into Systems

Article 25 goes beyond telling you to minimise. It requires you to build minimisation into the design of processing activities using appropriate technical and organisational measures.⁵

The “by default” element is equally binding. Systems must ensure that, by default, only personal data necessary for each specific purpose are processed. That obligation covers the amount collected, the extent of processing, how long data is stored, and who can access it. A registration form that pre-selects optional data-sharing checkboxes, or a database that grants broad internal access by default, fails this standard. The regulation expects privacy-protective defaults with opt-in for anything broader.

Purpose Limitation and Function Creep

Minimisation is tied to another Article 5 principle: purpose limitation. Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes.¹

In practice, an app that collects location data for navigation cannot quietly repurpose that data to build advertising profiles. The data was minimised for navigation; advertising is a separate purpose that would need its own basis and its own minimisation analysis. Preventing this kind of drift requires internal controls over how databases are queried and by whom. A marketing team pulling from a customer-support database for campaign targeting is exactly the pattern regulators look for.

A Note on AI and Machine Learning

Training machine learning models on personal data raises minimisation issues that standard compliance checklists may not cover. Research published by the ACM notes that current minimisation practices, when applied to ML training sets, do not necessarily deliver the privacy protection regulators expect, because reconstruction and re-identification risks are inherent to trained models.⁶ A dataset that looks minimised by traditional standards can still leak individual-level information once a model has been trained on it.

Keeping Data No Longer Than Necessary

Once the purpose has been fulfilled, the default expectation is deletion. Article 17 gives individuals the right to request erasure when data is no longer necessary for the purpose it was collected for, and controllers must act without undue delay.⁷ The alternative is genuine anonymisation, which takes the data out of the GDPR’s scope entirely.⁸

Several situations legally override the obligation to erase:

Legal obligations. Tax, accounting, and employment records across EU member states commonly carry statutory retention periods that must be observed.
Legal claims. Data can be retained for the duration of applicable limitation periods if it may be needed to defend against or bring claims.
Research and archiving. Article 89 permits further processing for archiving in the public interest and for scientific, historical, or statistical purposes, provided appropriate safeguards, including minimisation, are in place. Pseudonymisation or anonymisation should be used wherever the research purpose allows it.⁹
Freedom of expression and public health. Data needed for journalistic purposes or public health reasons can be retained.

These exceptions do not license leaving data in forgotten systems. You need a documented retention schedule that maps each data category to a specific legal justification and a defined retention period. When the period expires, the data should be deleted, anonymised, or archived with restricted access.

Pseudonymisation vs. Anonymisation

These two terms sound similar but carry very different legal consequences, and the distinction determines whether the GDPR applies at all.

Pseudonymised data has been processed so it can no longer be attributed to a specific person without additional information held separately. A database where names are replaced with random codes, with a separate key file that can re-link them, is pseudonymised. It is still personal data under the GDPR, so minimisation and every other rule continues to apply.¹⁰

Anonymised data has been stripped of identifiers so thoroughly that no one can re-identify the individual using any means reasonably likely to be used. The GDPR expressly does not apply to truly anonymous information.¹⁰ The bar is high: assessments must account for cost and time of re-identification, available technology, and future technological developments. Many datasets that organisations believe are anonymised turn out to be pseudonymised once tested rigorously.

What Non-Compliance Costs

Article 83 creates a two-tier fine system. Breaches of the Article 5 processing principles, including minimisation, fall in the upper tier and can reach €20 million or 4% of total worldwide annual turnover, whichever is higher. The lower tier, capped at €10 million or 2% of global turnover, applies to less severe infractions such as failing to maintain proper records of processing.¹¹

Fines are one piece of the enforcement toolkit. Article 58 gives supervisory authorities corrective powers that include formal warnings and reprimands, orders to bring processing into compliance within a set timeframe, temporary or permanent bans on processing, and suspension of data transfers outside the EU.¹² A processing ban can halt core operations until regulators are satisfied.

Individuals also have their own route. Article 82 gives any person who has suffered material or non-material damage from a GDPR breach the right to receive compensation from the controller or processor responsible.¹³ Non-material damage covers distress and anxiety, not only financial loss. Where multiple controllers or processors share responsibility, each can be held jointly liable for the full damage. A controller or processor escapes liability only by proving it was not in any way responsible for the event that caused the harm, which is a steep standard. Holding more data than you need enlarges the attack surface and makes it harder to argue that the excess was not part of the problem.

Practical Steps for Compliance

Demonstrating minimisation needs more than good intentions. The ICO recommends a concrete checklist: confirm that you only collect personal data you actually need for your stated purposes, that you hold enough to properly achieve those purposes, and that you periodically review what you hold and delete anything no longer necessary.²

Data Protection Impact Assessments

For high-risk processing, a Data Protection Impact Assessment is mandatory. The DPIA is designed to identify and mitigate data protection risks early, before a project goes live.¹⁴ If it surfaces residual high risks you cannot mitigate through safeguards, you must consult the relevant supervisory authority before proceeding. The DPIA process often forces minimisation questions that would otherwise be skipped, such as whether a less intrusive collection method could achieve the same goal.

Periodic Reviews

Minimisation is not a one-time exercise at launch. Review the personal data you hold on a regular schedule, checking whether it remains relevant and adequate for its stated purpose. Building annual data audits into your compliance programme is the most reliable way to keep data from accumulating beyond what you can justify.

1
General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data
2
Information Commissioner’s Office (ICO). Data Minimisation
3
Legislation.gov.uk. Regulation (EU) 2016/679 – Article 4
4
General Data Protection Regulation (GDPR). Art. 6 GDPR – Lawfulness of Processing
5
General Data Protection Regulation (GDPR). Art. 25 GDPR – Data Protection by Design and by Default
6
ACM Digital Library. The Data Minimization Principle in Machine Learning
7
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
8
European Commission. Do We Always Have to Delete Personal Data if a Person Asks
9
General Data Protection Regulation (GDPR). Art. 89 GDPR – Safeguards and Derogations Relating to Processing for Archiving Purposes in the Public Interest, Scientific or Historical Research Purposes or Statistical Purposes
10
Privacy-Regulation.eu. Recital 26 EU GDPR
11
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
12
General Data Protection Regulation (GDPR). Art. 58 GDPR – Powers
13
General Data Protection Regulation (GDPR). Art. 82 GDPR – Right to Compensation and Liability
14
Data Protection Commission. Data Protection Impact Assessments