ISC Privacy · Updated November 2026
Data Minimization vs Purpose Limitation: How Much Data Should the Company Collect?
Privacy controls are not only about securing data after collection. They also ask whether the organization should collect and use that data at all.
Data minimization
Collect only the personal information reasonably necessary for the defined business or legal purpose.
Purpose limitation
Use personal information for the stated or compatible purposes rather than silently repurposing it for unrelated objectives.
Retention connection
Keeping data indefinitely can undermine minimization goals even when the original collection was justified.
Why security is not enough
Perfectly encrypted unnecessary data can still create privacy risk because the collection and use itself may be excessive.
The takeaway
Data minimization limits how much data is collected. Purpose limitation restricts why the data is collected and how it is later used.
Related Summit guides
FAQ
Is data minimization the same as encryption?
No.
Can purpose limitation restrict secondary use?
Yes.
Does keeping unnecessary data increase privacy risk?
Yes.