Questio n: According to the principle of data minimization, data must be:

The principle of data minimization is explicitly defined in Article 5(1)(c) of the General Data Protection Regulation (GDPR). It mandates that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." This core principle ensures that organizations do not collect or hold more data than is strictly required to achieve their specified and legitimate purposes. By limiting data collection to the absolute minimum, organizations reduce the potential risks to data subjects, such as those arising from data breaches or misuse.

A. This statement describes the principle of 'storage limitation' as outlined in GDPR Article 5(1)(e), not data minimization.
B. This describes the 'purpose limitation' principle found in GDPR Article 5(1)(b), which is related but distinct from data minimization.
D. This suggests a fixed retention period, which is incorrect. The GDPR's 'storage limitation' principle is based on necessity, not an arbitrary timeframe.

1. Official Journal of the European Union, Regulation (EU) 2016/679 (GDPR).

Article 5(1)(c): "Personal data shall be: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);"

Article 5(1)(b): Defines the 'purpose limitation' principle.

Article 5(1)(e): Defines the 'storage limitation' principle.

2. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer.

Page 61, Section 4.2.3: The text explicitly discusses the principle of data minimization, stating, "According to Art. 5(1)(c) GDPR, personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed... This principle requires a data controller to carefully consider which data it actually needs." This directly supports option C.

3. Hoofnagle, C. J., van der Sloot, B., & Zuiderveen Borgesius, F. (2019). The European Union general data protection regulation: what it is and what it means. Information & Communications Technology Law, 28(1), 65-98.

Page 75, Section "Data processing principles": The article reviews the core principles of the GDPR, clearly distinguishing data minimization (Art. 5(1)(c)) from purpose limitation (Art. 5(1)(b)) and storage limitation (Art. 5(1)(e)), reinforcing that the options describe separate, distinct principles.

DOI: https://doi.org/10.1080/13600834.2019.1573501