What is data minimisation?

One of the core principles of UK GDPR is that businesses should collect and hold only the personal data they genuinely need for a specific, stated purpose. This principle — data minimisation — sounds straightforward but has practical implications for how businesses design their data collection processes, what they ask for on forms, and how long they retain information once it is no longer needed.

Data minimisation requires that personal data collected must be adequate, relevant, and limited to what is necessary. Collecting more data than needed, asking for information out of habit rather than necessity, or retaining data after the purpose for holding it has passed are all failures of this principle. Businesses must be able to demonstrate that each piece of data they hold has a clear and current justification.

In practice, data minimisation means reviewing what is collected at each touchpoint — website forms, customer records, marketing lists — and removing fields that are not genuinely necessary. It also means having a retention policy that triggers deletion or anonymisation when data is no longer needed. Our guide to data minimisation and retention for UK businesses covers the practical steps involved.