What is data minimization?

Process only the necessary data, for the necessary time, for the stated purpose.

Definition

Data minimization is the principle according to which processing should be limited to the minimum necessary to achieve its purposes, encompassing only relevant, proportionate, and non-excessive data.

In the LGPD (Brazilian General Data Protection Law), the principle appears under the name of necessity. It applies to data collection (don't ask for what you don't need), access (those who don't need it won't see it), and retention (delete when the purpose ends).

What does the LGPD say?

Article 6, III, of LGPD It establishes the principle of necessity; Article 15 determines the termination of processing when the purpose is achieved or the data is no longer necessary; and Article 16 mandates the deletion of data after termination, except in cases of legal obligation. The GDPR introduces the same principle in Article 5, 1, c, under the name of data minimization.

In practice

Review forms and registrations: each field needs a justification.
Define retention periods for each treatment activity and automate disposal.
Restrict access by profile and need.
Use anonymization or pseudonymization when identification is not required.

How Privacy Tools it deals with the topic

O Data Mapping For each activity, it records the data processed and the retention period; Data discovery finds excessive or forgotten data in databases and files; the Diagnoses and Assessments They verify adherence to the principle.

Updated October 3th, 2026.

Want to see this concept applied in practice?

Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.