What is Data Minimization?

Minimization inverts the instinct that has governed a decade of data strategy: collect everything, decide later. Under GDPR it is a binding principle, not advice — processing must be limited to what is necessary in relation to the purposes, and violations of the principles carry the higher fine tier (up to €20 million or 4% of global turnover). The CPRA imported the concept into California law, requiring that collection and use be 'reasonably necessary and proportionate' to the disclosed purposes, and most newer state laws contain similar language.

The test operates field by field and purpose by purpose. An order needs a shipping address; it does not need a birth date. A newsletter needs an email; the signup form asking for phone and gender is collecting beyond its purpose unless those serve a disclosed, necessary function. Minimization also governs time (retention limits — data no longer necessary should be deleted or anonymized), access (only staff who need it), and granularity (coarse location where precise location is not required).

Beyond compliance, minimization is risk engineering: data you never collected cannot be breached, subpoenaed, leaked by a vendor, or turned into class-action exposure. Breach costs and DSAR effort scale with the size of the data estate; the cheapest record to protect is the one that does not exist.

The operational practice: justify each field at collection design, default forms to the minimum, set retention schedules per purpose, and audit periodically for fields nothing consumes — the 'we might need it someday' columns are where minimization goes to die.