Basics 3 minutes read

As little as possible, as much as necessary

Article 5(1)(c) GDPR requires data to be adequate for the purpose and limited to what is necessary. The principle sounds like abstinence but works mainly as protection: what was never collected can neither leak nor be stolen.

Data minimisation is often misread as thrift – as an instruction to collect little in general. That misses the idea. The yardstick is not volume as such but the relationship between data and purpose. A bank asking for extensive details in a creditworthiness check does not breach the principle; a newsletter form asking for a date of birth does.

The test therefore always runs in the same direction: the purpose is settled first, and what data it carries follows from that. The reverse – collect first, look for a purpose later – inverts the order and misses the principle entirely.

One form, checked field by field

Newsletter sign-up: which field carries which purpose

  • Email addressno delivery without it
  • Time and version of the consentArticle 7(1) requires the proof
  • First namesalutation only, therefore optional
  • Date of birthno discernible purpose in sending
  • Phone numberunrelated and particularly sensitive
Bar length stands for proximity to the stated purpose, not for a measured value. The bottom two fields nonetheless appear in a great many forms – usually justified by the thought that the data might come in useful later. That justification is precisely what the principle rules out.

It is striking how often the lower fields appear marked with an asterisk as mandatory. That is the most common breach of the principle in practice, and also the easiest to fix: a field not needed for the purpose may at most be optional. As a mandatory field it ties the service to a disclosure that has nothing to do with the service.

The principle applies to the banner too

A consent banner collects data itself – necessarily so, because a decision without storage would be gone after the next page load. The principle demands the same here as everywhere: what is stored is what carries the proof, and nothing else.

In practice that means a small bundle: which purposes were confirmed, when, against which version of the text, and an identifier that finds the same decision on the next visit. A full IP address is not part of it, and a browser fingerprint even less so. Both nonetheless turn up regularly in off-the-shelf products, usually under the heading of fraud detection.

The question that comes before every field

Could the stated purpose be fully achieved without this field?
YesThen the field is not necessary. It goes, or it stays expressly optional with no disadvantage for leaving it blank.
NoThen the purpose carries the field – and the same question repeats for scope: does the month suffice instead of the full date, the region instead of the address?
The second round is the more effective one. Whole fields are rarely superfluous; their precision very often is.

That leaves the uncomfortable side of the principle. It contradicts a widespread reflex – collecting data because storage is cheap and some later analysis seems conceivable. The reflex is not malicious but convenient, and stubborn for exactly that reason. The Regulation sets one plain condition against it: the purpose is settled before collection, or collection does not happen.

Published 12 October 2026

This article explains general principles and does not replace legal advice on an individual case.

Read next

Back to the overview