What is the Data Minimisation Principle?

Updated: August 2025

Article 5(1)(c) of the GDPR says: “1. Personal data shall be: (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation)”

So you should identify the minimum amount of personal data you need to fulfil your purpose. You should hold that much information, but no more.

This is the first of three principles about data standards, along with accuracy and storage limitations.

The accountability principle means that you need to be able to demonstrate that you have appropriate processes to ensure that you only collect and hold the personal data you need.

Also bear in mind that the UK GDPR says individuals have the right to complete any incomplete data which is inadequate for your purpose, under the right to rectification. They also have the right to request that you delete any data that is not necessary for your purpose, under the right to erasure (right to be forgotten).

Key Takeaways

• The principle of data minimisation requires you to collect and process only the personal data that is strictly necessary for your stated purpose. Before collecting any data, you must clearly define why you need it.

• Holding more data than needed is unlawful. You should not collect personal data “just in case” it might be useful later. Data collection must be adequate, relevant, and limited to what is essential for the task at hand.

• Data minimisation is not a one-time task. You must periodically review the data you hold to ensure it’s still relevant and delete anything you no longer need. Individuals have rights, like erasure and rectification, to challenge data that is unnecessary or incomplete.

How do we decide what is adequate, relevant and limited?

The UK GDPR does not define these terms. Clearly, though, this will depend on your specified purpose for collecting and using the personal data. It may also differ from one individual to another.

So, to assess whether you are holding the right amount of personal data, you must first be clear about why you need it.

For special category data or criminal offence data, it is particularly important to make sure you collect and retain only the minimum amount of information.

You may need to consider this separately for each individual, or for each group of individuals sharing relevant characteristics. You should, in particular, consider any specific factors that an individual brings to your attention – for example, as part of an objection, a request for rectification of incomplete data, or a request for erasure of unnecessary data.

You should periodically review your processing to check that the personal data you hold is still relevant and adequate for your purposes, and delete anything you no longer need. This is closely linked with the storage limitation principle.

When could we be processing too much personal data?

You should not have more personal data than you need to achieve your purpose. Nor should the data include irrelevant details.

If you need to process particular information about certain individuals only, you should collect it just for those individuals – the information is likely to be excessive and irrelevant in relation to other people.

You must not collect personal data on the off-chance that it might be useful in the future. However, you may be able to hold information for a foreseeable event that may never occur if you can justify it.

If you are holding more data than is actually necessary for your purpose, this is likely to be unlawful (as most of the lawful bases have a necessity element) as well as a breach of the data minimisation principle. Individuals will also have the right to erasure. 

When could we be processing inadequate personal data?

If the processing you carry out is not helping you to achieve your purpose, then the personal data you have is probably inadequate. You should not process personal data if it is insufficient for its intended purpose.

In some circumstances, you may need to collect more personal data than you had originally anticipated using, so that you have enough information for the purpose in question.

Data may also be inadequate if you are making decisions about someone based on an incomplete understanding of the facts. In particular, if an individual asks you to supplement incomplete data under their right to rectification, this could indicate that the data might be inadequate for your purpose.

Obviously, it makes no business sense to have inadequate personal data – but you must be careful not to go too far the other way and collect more than you need.

What about the adequacy and relevance of opinions?

A record of an opinion is not necessarily inadequate or irrelevant personal data just because the individual disagrees with it or thinks it has not taken into account information they think is important.

However, in order to be adequate, your records should make clear that it is an opinion rather than a fact. The record of the opinion (or of the context it is held in) should also contain enough information to enable a reader to interpret it correctly. For example, it should state the date and the author’s name and position.

If an opinion is likely to be controversial or very sensitive, or if it will have a significant impact when used or disclosed, it is even more important to state the circumstances or the evidence it is based on. If a record contains an opinion that summarises more detailed records held elsewhere, you should make this clear.

FAQs

What does ‘adequate, relevant, and limited’ actually mean? These terms are not explicitly defined in the UK GDPR. Their meaning depends entirely on your specific, declared purpose for processing the data. You must be able to justify that every piece of data you hold is necessary to achieve that purpose.

Can I get in trouble for holding too much data? Yes. Holding more personal data than you need for your purpose violates the data minimisation principle and is likely unlawful. It also means individuals can exercise their right to erasure (right to be forgotten) to have the unnecessary data deleted.

How should I handle opinions recorded as personal data? An opinion is not automatically irrelevant just because someone disagrees with it. To be adequate, your records must clearly state that it is an opinion, not a fact. You should also include context, such as who recorded the opinion and when, to ensure it can be interpreted correctly.