What is the purpose of the data minimization principle in privacy?

• A. Collect all data regardless of necessity.
• B. Encrypt all data to minimize exposure.
• C. Store data in multiple jurisdictions.
• D. Collect only what is necessary; reduces risk and regulatory burden.

Answer: (D)

Data minimization means you gather only what is necessary for a specific, legitimate purpose. By keeping only what you truly need, you limit the amount of personal data at risk in a breach and make privacy compliance easier, since many laws require restricting data collection and retention to what’s necessary for the stated purpose. This directly reduces both risk and regulatory burden.

Collecting everything regardless of necessity would raise risk and complicate compliance. Encryption helps protect data you already have but doesn’t limit what you collect. Storing data in multiple jurisdictions concerns data location and transfer rules rather than limiting collection.