Data minimization

Collect only the data you actually need for the job, and don't keep it longer than necessary.

The Simple Version

Collect only the data you actually need for the job, and don't keep it longer than necessary.

Detailed Explanation

Data minimisation is enshrined in Article 5(1)(c) of the GDPR and is also relevant to EU AI Act requirements on training data governance. In AI contexts, minimisation creates tension with the common assumption that more training data yields better models — organisations must document a legitimate basis for the breadth of data collected and must consider whether synthetic data or aggregated datasets can substitute for personal data. Minimisation also applies to inference: AI systems that collect user data at inference time must justify collection against the purposes declared in privacy notices.

Key Characteristics

• Legal requirement under GDPR Article 5(1)(c) for personal data processing
• Requires documented justification for the scope and volume of data collected
• Applies both to training data collection and to inference-time data capture
• Encourages consideration of privacy-preserving alternatives such as synthetic data

Why It Matters

AI teams must work with privacy counsel to establish data minimisation policies for training datasets — particularly for models processing health, financial, or biometric data where GDPR and sector regulations overlap.

Real-World Analogy

Like only collecting the identity documents strictly required for a background check — taking a full passport copy when only a date of birth is needed violates the spirit and letter of minimisation.

Common Misconceptions

• Data minimisation conflicts with AI model performance goals and is therefore impractical — privacy-preserving techniques (differential privacy, synthetic data) increasingly make minimisation compatible with good model performance.
• Minimisation only applies to personal data — good data governance extends minimisation principles to all sensitive data types.

Related Terms

• data governance
• data preparation
• dataset bias
• data lifecycle

Related Articles

• Data Governance Frameworks in the Age of Generative AI
• AI Shopping Visibility, Data Governance, and Risk
• What a Semantic Mapping of the EU AI Act and ISO/IEC 5259 Reveals

Sources & Further Reading

• GDPR Article 5(1)(c) — EUR-Lex

Data minimization: Direct Definition

Collect only the data you actually need for the job, and don't keep it longer than necessary.

Technical Definition

Data minimisation is enshrined in Article 5(1)(c) of the GDPR and is also relevant to EU AI Act requirements on training data governance. In AI contexts, minimisation creates tension with the common assumption that more training data yields better models — organisations must document a legitimate basis for the breadth of data collected and must consider whether synthetic data or aggregated datasets can substitute for personal data. Minimisation also applies to inference: AI systems that collect user data at inference time must justify collection against the purposes declared in privacy notices.

Why It Matters

AI teams must work with privacy counsel to establish data minimisation policies for training datasets — particularly for models processing health, financial, or biometric data where GDPR and sector regulations overlap.