The GDPR describes the principle of data minimization. How can organizations comply with this principle?

The principle of data minimization is explicitly defined in Article 5(1)(c) of the GDPR. It mandates that personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed." This means organizations must identify the minimum amount of personal data required to fulfill a specific, legitimate purpose and process only that data. It is a core principle of data protection by design and by default, ensuring that data collection is not excessive.

A. Applying the concept of least privilege relates to access control and security, which falls under the principle of integrity and confidentiality, not data minimization.
B. Limiting access rights is a security measure to ensure confidentiality (Article 5(1)(f) GDPR), not a method for minimizing the amount of data collected initially.
D. Limiting file sizes is a technical data storage practice. It does not address the legal requirement to limit the scope and volume of personal data being processed.

1. General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679:

Article 5(1)(c): "Personal data shall be: ... (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);" This is the direct legal definition supporting answer C.

2. Information Commissioner's Office (ICO) - Guide to the GDPR:

Principle (c): Data minimisation, Section: "You must ensure the personal data you are processing is: adequate – sufficient to properly fulfil your stated purpose; relevant – has a rational link to that purpose; and limited to what is necessary – you do not hold more than you need for that purpose." This guidance directly elaborates on the definition in Article 5(1)(c).

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Page 100, Section 4.2.3.3: "The principle of data minimisation (Art. 5(1)(c) GDPR) requires that personal data must be adequate, relevant and limited to what is necessary for the purposes of the processing." This academic text confirms the definition and its practical application. (DOI: https://doi.org/10.1007/978-3-319-57959-7)