Which statement best describes data minimization in privacy governance?

• A. Data minimization means collecting as much data as possible to maximize insights.
• B. Data minimization is optional and only applies to certain projects.
• C. Data minimization means collecting and retaining only the minimum necessary personal data to achieve legitimate purposes.
• D. Data minimization requires storing data indefinitely to ensure future use.

Answer: (C)

Data minimization focuses on collecting and keeping only what is strictly necessary to achieve a defined, legitimate purpose. This approach reduces privacy risk by limiting the amount of personal data processed and the time it’s retained, aligning with governance expectations that data should be used only for stated purposes and not kept longer than needed. So, the best description is gathering the minimum data required for the purpose and disposing of it when it’s no longer needed. Collecting more data or storing it indefinitely would undermine minimization and increase risk and compliance challenges.