Data minimisation explained: what the principle asks of you before anything is collected
Data minimisation is the data protection principle that personal data must be adequate, relevant and limited to what is necessary for the purposes it is processed for, which in practice means designing the collection so that whatever the decision does not need is never gathered at all.
What does data minimisation mean?
Article 5(1)(c) of the GDPR sets it out in nine words: personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Data minimisation and data minimization are the same principle, spelled either way depending on which side of the Atlantic wrote the policy.
All three words carry weight, and the first one is the one people drop. Adequate means sufficient for the purpose, so under-collecting is also a failure of the principle. Relevant means connected to that purpose rather than to a purpose you might invent later. Limited to what is necessary is the test itself, and necessity is measured against the purpose you stated, which is why a vaguely worded purpose is not a loophole. It is a second problem sitting on top of the first.
Article 25(2) turns it into an engineering requirement: controllers must ensure that "by default, only personal data which are necessary for each specific purpose of the processing are processed", and the article applies that to the amount collected, the extent of processing, the storage period and who can reach it.
How data minimisation works in a capture or inspection flow
- Ask for the panel, not the driveway. Name the shot you need instead of requesting a walkaround and sorting it out later.
- Specify the fields. A structured question set collects an answer. An open request collects whatever the person decides to send.
- Prefer a dropdown to free text where the answer set is genuinely closed. Free text is where unrequested personal data about third parties turns up.
- Turn location off where location is not part of the decision. Precise coordinates are easy to collect and hard to justify after the fact.
- Do not collect identity documents "in case". In case is not a purpose.
- Separate the decision from the marketing. Different purpose, different lawful basis, and usually a different retention period.
There is a counterintuitive result here worth stating, because it cuts against the assumption that less technology means less data. An unstructured "email us some photos" process is usually worse for minimisation than a guided one. The customer decides what to send, sends more than anyone asked for, and the organisation now holds it. Structure is a minimisation tool, which is part of the case for guided photo capture over an open request.
Data minimisation example: the water damage claim
A kitchen leak needs four things: the affected flooring, the appliance, the meter reading and the stopcock. What an unguided request produces is a four-minute walkthrough of the whole house, including a child's bedroom and a passport lying open on the counter.
The claim gets assessed either way. The difference is that the insurer now holds material it never needed, cannot easily justify, and has to either delete or defend if the file is ever audited.
How data minimisation differs from data retention
Minimisation is about scope. Data retention is about time. They are separate tests under Article 5, and you can pass one while failing the other.
A disciplined 90-day retention window applied to material you should never have collected is still a minimisation failure. Getting the scope right first also makes the retention conversation easier, because there is less to argue about keeping.
Where minimisation and evidence collection pull against each other
Evidence work rewards context. The wide shot that proves the close-up shows the same vehicle. The surroundings that make a staged scene detectable. The metadata that anchors a file to a place and a moment. Every one of those is additional personal data, and every one of them is genuinely useful in a contested claim.
Minimisation says cut all of it unless it is necessary. Necessity, in exactly these cases, is the thing under dispute. Anyone who tells you a product setting resolves that is selling you a setting.
What resolves it is a written judgement, made once per flow and reviewed. State what the decision genuinely requires. Decide whether contextual evidence is necessary for fraud control, and if you are relying on legitimate interests, document the balancing test rather than assuming it. Accept that the answer will differ between a routine service intake and a high-value first-party claim, and build two flows rather than one compromise. That is a policy decision with a named owner, not a toggle in an admin panel.
When does data minimisation apply?
To every processing operation, continuously, whatever your lawful basis. Consent does not buy an exemption: the Article 5 principles apply on top of the Article 6 basis, not instead of it. A customer agreeing to send you a video does not make it necessary for you to keep footage of their living room.
The enforcement exposure matches. Article 5 breaches sit in the higher tier under Article 83(5), up to 20 million euro or 4% of total worldwide annual turnover, whichever is higher. The wider framework is set out in our note on the GDPR, and the practical trade-off against contested claims runs through the whole evidence integrity question.