GDPR Data Minimization: Rules, Retention, and Fines

GDPR data minimization is the rule in Article 5(1)(c) that limits you to collecting personal data that is adequate, relevant, and limited to what is necessary for a specific, stated purpose. Break it, and the fine ceiling is €20 million or 4% of worldwide annual turnover, whichever is higher.¹ The principle sounds simple. Applying it means every field on every form, every column in every database, and every backup copy has to justify its existence.

The Three Tests Inside Article 5(1)(c)

Each piece of personal data you hold has to pass three tests tied to the purpose you declared at collection.² Fail any one and the data shouldn’t be in your systems.

Adequate means you’ve collected enough to actually do the job. If shipping a product requires a full address, collecting only a zip code is inadequate, and inadequacy tends to become an excuse for demanding more data later.

Relevant means every field has a logical link to the processing activity. Asking for a date of birth on a newsletter signup has no connection to sending emails, and regulators read that mismatch as overreach.

Limited to what is necessary means that even relevant data has a ceiling. If a city and country would support geo-targeted marketing, you can’t collect a full home address. Fewer fields when fewer fields will do is an obligation, not a preference.

Purpose Controls Everything

Minimization can’t be judged in the abstract. Article 5(1)(b) requires that personal data be collected for specified, explicit, and legitimate purposes, and not processed later in ways that conflict with those purposes.² The purpose you write down at the moment of collection is what “necessary” gets measured against.

Collecting email addresses for order confirmations doesn’t automatically license marketing use of those same addresses. If you want a new use, you have to check compatibility with the original purpose, considering things like the link between the two purposes, the collection context, the presence of sensitive categories, the consequences for the individual, and safeguards like pseudonymization.³ Holding data because it “might be useful someday” fails on its face. A legitimate interest has to be real and present, not speculative.⁴

Privacy By Default Is the Engineering Version of the Rule

Article 25 turns the principle into a system requirement. Controllers must build technical and organizational measures that enforce minimization from the design stage and throughout operation, and systems must be configured out of the box to process only the personal data necessary for each specific purpose.⁵ The “by default” obligation covers four axes: how much data is collected, how far it’s processed, how long it’s kept, and how many people can see it.

A registration form with every checkbox pre-ticked violates this. So does a social media profile that is public until the user makes it private. The European Data Protection Board has stated that Article 25 applies to controllers regardless of size and reaches existing systems, not just new deployments.⁶ Legacy databases don’t get grandfathered.

How Long You Can Keep the Data

Minimization doesn’t stop at collection. Article 5(1)(e) requires that personal data be kept in identifiable form only for as long as the processing purpose demands.² Once the purpose is fulfilled, the data has to be deleted, anonymized, or archived under strict conditions. Longer retention is allowed only for archiving in the public interest, scientific or historical research, or statistical purposes, and only with appropriate safeguards.

The regulation does not prescribe a fixed retention period for every data type, because retention depends on the purpose and any other legal obligations you carry. Tax records may need years. Server logs may need weeks. What matters is that you define the period before you start collecting, document it, and enforce it through automated deletion or scheduled review. Indefinite retention is never compliant.

What Individuals Can Force You to Delete

Data subjects have their own enforcement tool. Article 17 lets an individual demand erasure, and you must comply without undue delay when certain conditions apply. The one most tied to minimization is the first: the data is no longer necessary for the purpose it was collected for.⁷ Other grounds include withdrawn consent, a successful objection to processing, and unlawful processing.

If you’ve been minimizing properly, erasure requests are simple, because data without current justification shouldn’t be there anyway. Article 5(1)(d) adds the accuracy principle: reasonable steps must be taken to erase or correct inaccurate data without delay.² Outdated information that no longer serves its purpose should be deleted as routine hygiene, not held until someone complains.

Anonymization and Pseudonymization Are Not the Same

When you want to keep the analytical value of data without the privacy burden, the GDPR draws a sharp line between two techniques.

Anonymization transforms data so that no individual can be identified by any means. Truly anonymized data is outside the GDPR because it no longer qualifies as personal data.⁸ The bar is high. The original data must be securely destroyed so no one can reverse the process, and if any realistic path back to identifying someone remains, the data isn’t anonymous and the GDPR still applies.⁹

Pseudonymization swaps identifiers for artificial ones while keeping the original data, or a re-identification key, stored separately. Under Article 4(5), pseudonymized data is still personal data and stays fully subject to the GDPR.¹⁰ The regulation encourages the technique as a safeguard, but it does not reduce your compliance load. Most datasets organizations describe as “anonymized” are pseudonymized, because the key still exists somewhere.

AI Training Is Where Minimization Bites Hardest

Machine learning benefits from volume, and the GDPR contains no carve-out for it. Purpose, lawful basis, and proportionality all still apply. The EDPB’s December 2024 opinion on AI models states that when legitimate interest is the basis for training, regulators weigh the volume of personal data against the interest being pursued and against the minimization principle. Controllers also have to consider whether data subjects reasonably expected this use and whether they even knew their data was online.⁴

France’s CNIL has told AI developers to define a precise purpose rather than something generic like “development and improvement of an AI system,” referencing the type of model, its capabilities, and its conditions of use.¹¹ The tighter the purpose, the tighter the ceiling on how much training data you can justify.

The Documentation Regulators Actually Ask For

Article 30 requires a written record of every processing activity. This is the first thing an auditor asks to see. At minimum it must contain:

Controller details, including any joint controllers and the data protection officer
Categories of data subjects and the categories of data held on them
The processing purpose for each category
Retention timelines for each category
A general description of the technical and organizational security measures

These requirements come directly from the regulation’s text.¹² Organizations with fewer than 250 employees are exempt only if their processing is occasional, involves no sensitive data, and poses no risk to individuals’ rights. Very few organizations meet all three conditions, so treat the record-keeping duty as universal.

Fines and Real Enforcement

The GDPR uses two tiers of administrative fines, and minimization violations sit in the higher one.

Upper tier under Article 83(5): violations of the core processing principles in Article 5, including data minimization, carry fines up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹
Lower tier under Article 83(4): violations of the record-keeping duty in Article 30 and the privacy-by-design requirements in Article 25 carry fines up to €10 million or 2% of worldwide annual turnover.¹

An organization can have a defensible minimization policy and still land in the lower tier by failing to document it. Regulators use the full range. France’s CNIL fined Clearview AI the maximum €20 million for scraping billions of facial images without a legal basis and ordered deletion of all data on French residents within two months, with a €100,000 penalty for each day of delay.¹³ Italy’s regulator fined Poste Italiane €6.6 million and its subsidiary Postepay €5.9 million for retaining customer data long after the original purpose had ended without adequate technical measures to enforce deletion.

Fines are not mechanical. Regulators weigh the nature and severity of the breach, cooperation, prior infractions, and mitigation. The EDPB’s guidelines require that every fine be effective, proportionate, and dissuasive in the specific case.¹⁴

Getting to Compliance

Practical compliance starts with a data necessity assessment. For every processing activity, identify the specific purpose, the categories of data subjects, the data fields involved, and the legal basis under Article 6.¹⁵ Then ask the hard question of each field: can the stated purpose be met without it? Interviews with department heads routinely uncover silos of redundant data that should have been purged years earlier.

When a DPIA Becomes Mandatory

For higher-risk processing, the assessment becomes a formal Data Protection Impact Assessment under Article 35. A DPIA is required before you begin processing likely to result in high risk to individuals’ rights, and the regulation names three triggers: automated decision-making with legal effects, large-scale processing of sensitive data, and systematic monitoring of publicly accessible areas.¹⁶ Employee monitoring almost always qualifies, because systematic tracking can inadvertently sweep in sensitive categories like health or political information. The technical ability to monitor does not create a legal right to do it.

Deletion That Actually Works

Once the assessment flags data that shouldn’t be there, the technical work begins. Small datasets can be cleaned manually. Anything at scale needs automated purge scripts running on schedule against records that have exceeded their retention period. Where full deletion isn’t practical, masking replaces sensitive portions with placeholders and hashing converts data to a fixed-length string, but neither counts as anonymization unless the original data and any re-identification keys are permanently destroyed.

The step organizations most often skip is verifying that deletion propagated. Backups, staging environments, warehouses, and third-party processors may still hold copies of records you believe you deleted from the primary database. Audit those secondary locations, confirm deletion is complete, and log the date and method. That audit trail is what turns your data lifecycle management from aspirational into defensible.

1
General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
2
General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data
3
European Commission. Can We Use Data for Another Purpose?
4
European Data Protection Board. Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models
5
GDPR Text. Article 25 GDPR Data Protection by Design and by Default
6
European Data Protection Board. Guidelines on Data Protection by Design and by Default
7
General Data Protection Regulation (GDPR). Art. 17 GDPR Right to Erasure (Right to Be Forgotten)
8
General Data Protection Regulation (GDPR). Recital 26 GDPR
9
Data Protection Commission. Anonymisation and Pseudonymisation
10
General Data Protection Regulation (GDPR). Art. 4 GDPR Definitions
11
CNIL. AI System Development: CNIL’s Recommendations to Comply With the GDPR
12
General Data Protection Regulation (GDPR). Art. 30 GDPR Records of Processing Activities
13
European Data Protection Board. French SA Fines Clearview AI EUR 20 Million
14
European Data Protection Board. Guidelines 04/2022 on the Calculation of Administrative Fines Under the GDPR
15
General Data Protection Regulation (GDPR). Art. 6 GDPR Lawfulness of Processing
16
General Data Protection Regulation (GDPR). Art. 35 GDPR Data Protection Impact Assessment