The privacy principle of collecting only the personal data genuinely necessary for a specific, stated purpose, rather than collecting broadly in case data might be useful later.
Why it matters
Data minimization reduces both legal exposure (less data collected means less that could be involved in a breach or a compliance violation) and practical risk — data a company never collected in the first place can't be mishandled, leaked, or misused, no matter what happens later.
In a sentence
"We practice data minimization on our signup form — we only ask for what's actually needed to create the account, not every field that might theoretically be useful someday."
Related terms
- Often confused with: PII (Category 8, Part One) — PII is the category of data being discussed; data minimization is a principle about *how much* of that data to collect in the first place).