Data minimization

Collecting only what you actually need, and keeping it only as long as you need it.

If a service only needs to know that a customer is over 18, it does not need to keep their full birth date, a copy of their ID, or their address.

Limiting collection, retention, and processing of personal data to what is necessary for the stated purpose. In the EU's General Data Protection Regulation (GDPR), the principle says personal data must be adequate, relevant, and limited to what is necessary, and a companion principle, storage limitation, says it should be kept no longer than needed.

Data minimization shows up at several points:

• Collection, by asking only for the details a purpose requires.
• Use, by using data only for the purpose it was collected for.
• Retention, by deleting data when the purpose is met or a set period ends.
• Access, by limiting who can see the data.

Identity systems apply it in practical ways:

1. Estimating age from a selfie and not collecting an ID document, when the goal is only an age check.
2. Storing a biometric template, a mathematical summary, instead of the original photo.
3. Proving a fact with a credential, such as showing a person is over 18 without revealing their birth date.
4. Setting retention limits, so verification data is deleted on a schedule.

Data minimization sits next to terms that are easy to mix up:

• GDPR is the law that makes minimization a legal principle.
• Right to erasure is a person's right to have data deleted, which is easier to honor when less data exists.
• Age estimation is a method that can meet an age rule with less personal data.

For more, see the Privacy Hub.