Data minimization means collecting, retaining, and processing only the personal data necessary for a specified purpose. It treats privacy as a design constraint rather than an afterthought. section 3.14 section 3.4
A practical strategy connects data minimization with broader privacy responsibilities:
- Define the purpose for processing before gathering personal data. section 3.15
- Limit collection and retention to what the purpose requires, while protecting accuracy, confidentiality, and accountability. section 3.14 section 3.15
- Apply minimization throughout the technology lifecycle through careful data curation, privacy-enhancing preprocessing and training, and evaluation for memorization risks. section 3.4
Generative AI and personal data
A regulator's 2023 action concerning ChatGPT raised questions about lawful processing, transparency, age verification, and personal information. The case illustrates that minimizing data is part of a wider privacy and accountability framework, not a substitute for one. section 3.15
Figure 3.4 A timeline of data protection laws
Use the timeline to compare the GDPR with later privacy laws in Brazil, China, California, and other jurisdictions that emphasize or expand data-protection obligations. section 3.14
