Glossary

Data minimization

Collecting, keeping and exposing only the personal data needed for a stated purpose (GDPR Article 5(1)(c)). Data that is never collected cannot leak, so minimization also reduces the impact of a breach and the work of retention.

Defined in: Regulation (EU) 2016/679, the General Data Protection Regulation

Covered in

Guide

Data minimization and retention: collect less and prove that deletion works

Design collection and deletion around a data-flow graph that includes logs, derived tables, exports and restored backups, and use per-person keys so deletion can reach copies you cannot edit.