Data Minimization

What is data minimization?

Data minimization is the rule that you use only the personal data you need. The GDPR spells it "minimisation" and states it in Article 5(1)(c): personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed".

Each of the three words does work:

• Adequate: enough to do the job. The ICO's guidance describes it as sufficient to properly fulfil your stated purpose.
• Relevant: linked to that purpose.
• Limited: no more than the purpose needs. The ICO says you must not collect personal data "on the off-chance that it might be useful in the future".

The test is always against a purpose, so it depends on purpose limitation. You cannot say what is necessary until you have said what the data is for. A related principle, storage limitation in Article 5(1)(e), covers how long identifiable data is kept.

Minimization by default

Article 25(2) builds the rule into settings: by default, only the personal data necessary for each specific purpose should be processed. The EDPB's guidelines on Article 25 say this covers four things: the amount of data collected, the extent of processing, the storage period and who can access the data.

The guidelines list practical steps, among them:

• Avoid personal data altogether where the purpose allows it.
• Use aggregated or pseudonymized data where full identities are not needed.
• Limit access to the fewest people who need it.
• Delete or anonymize data once it is no longer needed.
• Do not create more copies of the data than necessary.

The duty reaches your vendors. The EDPB says the controller is responsible for these duties in the processing done by its processors and subprocessors, should take that into account when contracting with them, and should not choose providers whose systems do not support it.

In US law

The CCPA has its own version. Section 1798.100(c) says a business's collection, use, retention and sharing of personal information "shall be reasonably necessary and proportionate" to achieve the purposes for which it was collected or processed, or another disclosed purpose compatible with the context. See CCPA and CPRA.

Why it matters to you

Every field you send a vendor is a field that vendor can lose in a data breach. It is also data the vendor could reuse if its terms change later, for example for AI training, and data it must find and delete when someone asks.

Minimization is also something you may have to prove. Under Article 5(2), the controller must be able to demonstrate that it complies with the principles, including this one.

What to check

• Sync settings: which fields an integration pulls from your CRM or database, and whether you can turn off the ones the tool does not need.
• Default collection: features that collect more than you use, such as session replay, call recording or AI features enabled by default.
• Retention: how long the vendor keeps data and whether you can shorten it. See data retention.
• Access: who at your company and at the vendor can see the data.
• Terms changes: whether a new version of the vendor's terms or privacy policy lets it collect more of your data, or use it for more, than before.

How Venpo helps

You control what you send a vendor, but the vendor's documents decide what it may do with it. Venpo watches your vendors' terms, privacy policies, DPAs and AI policies and emails you a plain-English alert when a change widens what a vendor collects or how it uses your data. The Fine Print Scan answers, per vendor, questions such as whether AI is trained on your data, how many companies have your data and whether vendors keep it after you cancel.