What Is Data Minimisation? A Plain-English Guide

Data minimisation is a simple rule: collect only what you need. It protects you when companies follow it, and you can apply it to your own data too.

By Siddharth ShankarUpdated October 20, 2026

Every form that asks for your name, date of birth or phone number raises a quiet question: does this company really need that? Data minimisation is the legal answer for many organisations.

The principle in one sentence

The UK Information Commissioner’s Office describes data minimisation as holding only the personal data you need for a specified purpose, no more. Under the UK GDPR, the data must be adequate, relevant and limited.

• Adequate: enough to do the job properly.
• Relevant: clearly connected to the purpose.
• Limited: restricted to what is necessary, with no excess.

What organisations must do

According to the ICO, organisations should define the purpose first, because the data they need depends on it. They should collect only what that purpose requires. Collecting data on the off-chance that it might be useful later is not permitted. They should also review what they hold from time to time and delete data they no longer need, and be able to show how they do this.

Examples from the guidance

• Recruitment: health questions that matter only for certain manual jobs should not be asked of office job applicants.
• Employers: blood group data may be justified for staff doing hazardous work, but is likely excessive for the rest of the workforce.
• Debt collection: an agency that rules out people with similar names should delete most of their data but keep a minimal record so they are not contacted again.

Why it matters to you

Data that is never collected cannot be leaked, sold or misused. Many of the breaches in our guides, from National Public Data to AT&T, are worse because old data was still being kept. If an organisation holds less, a breach does less harm.

How to practise it yourself

When you can push back

If an organisation asks for data that seems unrelated to what it is doing for you, you can ask why it needs it and whether it is optional. In the UK and EU, a good answer refers to a specific purpose. A vague answer, or one that says it may be useful later, suggests the principle is not being followed.

Minimisation for small businesses

If you run a small business, the same idea applies to your own records. List the personal data you collect, write down why you need each item, and stop collecting the ones with no clear purpose. Then set a time to delete old records. It lowers your risk and your workload.

What it is not

Data minimisation is not the same as storage limitation, which is about how long data is kept. They work together: collect less, and keep it for less time. The ICO notes that organisations should take special care with special category data and criminal offence data. This page is a plain-English summary of guidance, not legal advice.