Data Minimisation

Data Minimisation is a core data protection principle requiring organisations to collect and process only the personal data that is strictly necessary for the specified, explicit, and legitimate purpose. It involves limiting collection (not gathering data 'just in case'), restricting access (only those who need the data should have it), and applying retention limits (deleting data once the purpose is fulfilled). Practically, this means designing forms to ask only for essential fields, avoiding unnecessary data replication, and conducting regular data audits to identify and delete stale personal data.