OneTrust Certified Privacy Professional Practice Exam

Which of the following best describes 'Data Minimization' as per GDPR?

1. Collecting the least amount of data necessary

2. Keeping data indefinitely

3. Only collecting data with explicit consent

4. Aggregating data for analysis

The correct answer is: Collecting the least amount of data necessary

Data Minimization under the General Data Protection Regulation (GDPR) is a principle that emphasizes the importance of limiting the data collection to what is necessary for the intended purpose. This means that organizations should only collect the least amount of personal data necessary to achieve their specific, legitimate objectives. By adhering to this principle, businesses can reduce the risks associated with data processing and enhance the privacy rights of individuals. The focus of this principle is on ensuring that organizations do not collect excessive or irrelevant data, which aligns with the overarching goal of GDPR to protect individual privacy and give control back to individuals over their personal information. Collecting only what is essential not only helps in compliance with GDPR but also fosters trust between organizations and the individuals whose data they handle.