Data minimization is the legal principle that requires organizations to collect only the personal information that is adequate, relevant, and limited to what is genuinely necessary for a specific, stated purpose. It is a binding obligation under the European Union’s General Data Protection Regulation, California’s privacy statute, HIPAA, and a growing list of state consumer privacy laws. The rule cuts against the instinct to gather everything now and figure out uses later, and regulators increasingly treat overcollection as a standalone harm rather than something that only matters after a breach.
What the Law Requires
The clearest formulation sits in GDPR Article 5(1)(c), which requires that personal data be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.”1General Data Protection Regulation (GDPR). Art. 5 GDPR – Principles Relating to Processing of Personal Data Three words do the work. Adequate means you gathered enough to accomplish the goal. Relevant means each data point connects logically to the service. Limited means you stop there, rather than sweeping up extras in case they prove useful.
Article 25 pushes the same idea into system design. Controllers must implement technical and organizational measures so that, by default, only the personal data necessary for each specific purpose is processed. That obligation covers the amount collected, the extent of processing, the storage period, and who can access the data.2General Data Protection Regulation (GDPR). Art. 25 GDPR – Data Protection by Design and by Default A form that captures ten fields cannot be defended on the ground that only three get used. The collection itself has to be justified.
California’s Privacy Rights Act carries the same duty in slightly different language. Under Cal. Civ. Code 1798.100(c), a business’s collection, use, retention, and sharing of personal information must be “reasonably necessary and proportionate” to achieve the purposes disclosed to the consumer.3California Legislative Information. California Civil Code 1798.100 – General Duties of Businesses That Collect Personal Information More than 20 states have now passed comprehensive consumer privacy laws, many with minimization language modeled on either the GDPR or California.
Federal sector laws add more layers. HIPAA’s minimum necessary standard at 45 CFR 164.502(b) requires covered entities to take reasonable steps to limit use, disclosure, and requests for protected health information to the minimum needed for the intended purpose.4U.S. Department of Health and Human Services. Minimum Necessary Requirement The Federal Trade Commission reaches overcollection through Section 5 of the FTC Act, treating it as unfair or deceptive when it contradicts a company’s own privacy statements or blindsides consumers.
Penalties for Overcollection
Because Article 5 is treated as a basic processing principle, GDPR violations of it fall into the higher fine tier: up to €20 million or 4% of the company’s total worldwide annual turnover for the preceding financial year, whichever is greater.5General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines European supervisory authorities have issued fines in the hundreds of millions of euros for processing principle violations, often citing minimization alongside failures of purpose limitation or lawful basis.
In the United States, FTC enforcement has picked up against companies that collect beyond what their disclosures justify. In late 2025, a court approved an order requiring Disney to pay $10 million to settle allegations that it enabled unlawful collection of children’s personal data. In early 2026, the FTC finalized an order against General Motors and OnStar over the collection and sale of geolocation data without informed consumer consent.6Federal Trade Commission. Privacy and Security Enforcement The pattern is clear: overcollection is treated as a violation in its own right, not just a factor that surfaces after a breach.
How to Decide What You Actually Need
Minimization starts before any data is collected. List every field you intend to capture, then match each one to a specific processing purpose: fulfilling a shipment, verifying age, processing a payment. If a field does not directly support one of those stated purposes, cut it. A business that needs to confirm someone is over 18 can ask for a birth year alone, rather than a full birth date, hometown, and gender.
This evaluation often takes the form of a Data Protection Impact Assessment. Under GDPR Article 35, a DPIA is required before processing that is likely to result in a high risk to individuals’ rights, including large-scale processing of sensitive categories, systematic monitoring of public areas, or automated decision-making that produces legal effects. The assessment must describe the processing operations, evaluate necessity and proportionality, assess risks to data subjects, and set out the planned safeguards.7General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment
The DPIA is not a one-time exercise. Operations change, new features ship, and fields creep back in. The inventory needs revisiting, and each entry should document why the chosen field is the least intrusive way to achieve the goal. Regulators expect a paper trail showing the justification came before the collection, not after.
Consent Interfaces That Violate the Rule
An organization can have a strong minimization policy on paper and still undermine it at the user interface. Dark patterns are design choices that push users into sharing more than they intend. The most common tactic is visual hierarchy: “Accept All” appears in bold color, while “Reject All” or “Manage Preferences” is grayed out, buried behind clicks, or hidden in menu layers.
Pre-checked consent boxes are a related problem. When every data-sharing toggle is on by default and the user has to actively uncheck each one, the design assumes consent rather than earning it. Friction-heavy opt-outs work the same way: one click to accept, multiple steps to refuse. Some services go further, requiring personal information just to exercise an opt-out right, or blocking access entirely behind a cookie wall.
Under the GDPR, consent must be freely given, and withdrawal must be as easy as granting it. Interfaces that make acceptance frictionless and rejection burdensome do not meet that standard. The FTC has treated dark patterns as deceptive practices under Section 5 in multiple actions. If the consent flow is engineered to maximize collection rather than respect user choice, minimization is being violated at the front door regardless of what the privacy policy says.
Retention Laws That Override Deletion
Minimization does not mean deleting everything the moment a transaction ends. Several federal laws require businesses to keep specific records for fixed periods, and those mandates take priority.
The IRS requires businesses to keep income tax records for at least three years from the filing date in most cases, extending to six years if more than 25% of gross income goes unreported, and indefinitely if a return is fraudulent or never filed. Employment tax records must be kept for at least four years after the tax becomes due or is paid, whichever is later.8Internal Revenue Service. Recordkeeping The EEOC requires all personnel and employment records to be retained for one year, with payroll records kept for three years under the Age Discrimination in Employment Act and Fair Labor Standards Act. If an employee is involuntarily terminated, records must be retained for one year from the termination date. When an EEOC charge has been filed, records stay until the final disposition of the charge or any resulting lawsuit.9U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
The workable approach is a retention schedule that maps every category of data to both its business purpose and any legal hold. Data covered by a statutory retention period stays until that period ends. Data with no retention mandate is purged on a defined timeline, kept as short as operations reasonably allow. Automating those schedules prevents the common failure of data sitting on servers indefinitely because no one remembered to delete it.
Deleting and Anonymizing What You No Longer Need
Once data has served its purpose and cleared any retention obligation, it needs to be removed for real. Genuine deletion means the information is unrecoverable, not merely flagged as inactive. NIST Special Publication 800-88 Rev. 1 defines three tiers of media sanitization.10National Institute of Standards and Technology. SP 800-88 Rev. 1 – Guidelines for Media Sanitization Clear uses logical techniques to overwrite data in user-accessible storage, defeating simple recovery methods. Purge applies techniques that make recovery infeasible even with state-of-the-art laboratory equipment. Destroy renders both the data and the storage media permanently unusable. Most organizations handling routine consumer data operate at Clear or Purge, reserving Destroy for hardware decommissioning or highly sensitive records.
Anonymization is an alternative when the goal is to keep data for statistics or research without holding identifiable records. Done properly, the resulting dataset falls outside personal data protection laws entirely. Done badly, it fails. Researchers have repeatedly re-identified supposedly anonymized datasets. In one well-known case, a graduate student cross-referenced anonymized Massachusetts health insurance records against public voter registration data and identified the governor’s medical history using only zip code, birth date, and gender. AOL released 20 million anonymized search queries in 2006, and New York Times reporters identified a specific individual from her search patterns within days. Simple pseudonymization, where names are replaced with numbers but the rest of the record stays intact, is especially vulnerable. If the approach would not survive a determined researcher with access to public records, it is not actually anonymous.
Honoring Deletion Requests
Minimization runs alongside a growing body of consumer deletion rights. Under GDPR Article 17, individuals can obtain erasure of their personal data without undue delay when the data is no longer necessary for the purpose it was collected, when they withdraw consent, when they object to processing and no overriding legitimate grounds exist, or when the data was unlawfully processed. A controller that has made personal data public and is obligated to erase it must also take reasonable steps to notify other controllers processing copies.11General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
The right is not absolute. It does not apply when processing is necessary for freedom of expression, compliance with a legal obligation, reasons of public health, archiving in the public interest, or the establishment and defense of legal claims. California’s CCPA/CPRA grants a comparable deletion right, with parallel exceptions for legal obligations and ongoing transactions.
Organizations that practice genuine minimization find deletion requests easier to handle. When you only hold what you need, there is less to locate, less to delete, and fewer downstream systems where copies might linger. Companies that collect broadly and sort it out later face a painful process when a request arrives, because the data has usually been copied into analytics platforms, backup systems, and third-party integrations that were never designed for retrieval or purging.
Restricting Internal Access
Minimization does not end at collection. Data that remains must be governed by strict internal access rules on a need-to-know basis. Employees see only what their job function requires. Someone in shipping might see a mailing address but not payment details or purchase history. Someone in billing sees payment information but not medical records or support ticket contents.
Third-party vendors need the same treatment through data processing agreements and technical barriers that limit what they can access and retain. Access logs should capture who queried a database, when, and which records were viewed. Regular audits catch a common failure: employees who change roles or leave the company but keep their old permissions. In many breaches, the initial entry point was a dormant account that should have been revoked months earlier.