Definition

Principle of collecting and retaining only personal data that is necessary for PV purposes (safety reporting, follow-up, regulatory obligations).

Example

Not collecting full address when city/country suffices for regulatory reporting.

Regulatory source

GDPR Art 5(1)(c), GVP Module VI

Common mistakes

Retaining full identifiers indefinitely beyond operational need.

Inspector question

How do you define and implement data minimization in case processing?

Related terms