Data minimisation refers to the act of restricting the personal data your organisation stores to what you have legitimate reasons to keep. This guide will help you understand this subject better, so that you can store data appropriately and remain compliant with the law. If you have any questions not answered below, please get in touch.
What is the data minimisation principle? Under 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary. In essence, as a business, you should only be collecting data that is strictly necessary to carry out the purpose for which it was collected
Data minimisation is all about streamlining processes and improving workflows. This means you are only collecting data of value, and reducing the risk of security breaches that could come with collecting larger volumes of data. As they say, less is more, and in this case, less risk.
Data minimisation is one of the first of three data protection principles, along with accuracy and storage limitation. You also need to consider the accountability principle, and how you can demonstrate your purpose of processing to data subjects and the ICO. You need to further acknowledge the rights of the data subject, for example, their right to access, deletion, and rectification. If they believe that the data you have collected does not aline with your purpose for processing, then you may be required to delete it.
Many businesses, unknowingly collect large volumes of data, putting them at risk from a data breach. A strong data minimisation culture embedded within an organisation will help reduce the likelihood of hoarding large volumes of unnecessary, and potentially fraudulent data. Tools that could be used to help enforce this forward-thinking include appropriate training, implementing policies and procedures, and screening processes.
Does your business have a data retention policy? If not, this is something you need to consider and keep under regular review. Having regular data purges allows businesses to focus on only the data they need to succeed. Time is money, and businesses do not have the time to sift through ‘stale’ data.
If you have any other questions or concerns, get in touch with us. We can support you when dealing with complex data protection needs, and can also train your staff.
Want to receive a copy of our monthly Data Protection newsletter and news from the DPAS team?
Helping organisations access the value of their data, create a vision, embed the change and build the future.
Please note all information on this website is for your help and guidance. It should not be regarded as an authoritative or definitive statement of the law.
