TL;DR: Data minimisation is a core GDPR principle: personal data must be "adequate, relevant and limited to what is necessary" for the purpose it was collected for. Companies should not collect data "just in case," and should review and delete what they no longer need. For you it means two things: share less in the first place, and use your rights to make companies delete what they hold, since data that was never kept cannot leak.
What the law says
Article 5(1)(c) of the UK and EU GDPR says personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." The ICO's guidance breaks that into three tests:
- Adequate: enough to properly fulfil the purpose.
- Relevant: has a rational link to the purpose.
- Limited: no more than is needed for that purpose.
The law doesn't set fixed lists. What counts as "necessary" depends on why the data is collected, and organisations must be able to show they've thought about it.
What it looks like in practice
The ICO gives examples:
- A recruiter hiring for an office job has no reason to ask about health conditions only relevant to manual work.
- An employer may keep blood group details for staff in hazardous roles, but not for its whole workforce.
- A debt collector that rules someone out should delete most of what it gathered, keeping only enough to avoid contacting them again.
The ICO also warns against holding data "on the off-chance" it might be useful, and expects organisations to review what they hold and delete what they no longer need. That links to a sister principle, storage limitation.
Why it matters for breaches
Most of the worst breaches are bad because companies kept data they didn't need: old customers' records, copies of ID documents, years of purchase history. The Discord support-vendor breach exposed ID photos submitted for age checks. Retail attacks such as the M&S and Co-op cyber attacks exposed customer records that sat in company databases. Data that isn't kept can't be stolen.
How to apply data minimisation to your own life
- Leave optional fields blank. Date of birth, gender and phone number are often optional on sign-up forms.
- Use aliases for shopping and newsletters. See email aliases and temporary numbers.
- Ask why. If a shop, gym or landlord wants a copy of your passport, ask what it's for and how long they keep it.
- Delete old accounts you no longer use instead of leaving them dormant.
- Use your rights. Ask companies what they hold with a subject access request, then ask them to erase what they don't need. Our GDPR rights explainer covers erasure.
- If a company refuses, complain to it and then to the regulator; see how to complain to the ICO.
Outside the UK and EU
The US has no single national privacy law, but several state privacy laws include their own limits on collecting and keeping personal data. See US state privacy laws for which rights apply where you live.
Minimising what you share going forward doesn't remove what's already leaked. A free email exposure check shows which past breaches included your email.
Frequently Asked Questions
What is data minimisation?
A GDPR principle that personal data must be adequate, relevant and limited to what is necessary for the purpose it is processed for.
Which article of GDPR covers data minimisation?
Article 5(1)(c) of the UK and EU GDPR.
What is an example of data minimisation?
The ICO says a recruiter for an office job should not ask about health conditions relevant only to manual work, and an employer should keep blood group data only for staff in hazardous roles.
Can I make a company delete data it does not need?
Under GDPR you can ask for erasure of data that is no longer necessary. Start with a subject access request to see what it holds.
Is data minimisation the same as storage limitation?
They are related. Minimisation is about collecting and holding only what is needed; storage limitation is about not keeping it longer than needed.