Principle 3: Data minimisation

The third principle requires that we ensure the personal data we are processing is:

  • adequate – we have sufficient personal data to fulfil the purpose of processing that we stated
  • relevant – the personal data we are processing has a clear link to the purpose
  • limited – we are not processing more data than we need to fulfil the purpose

We might summarise this as ‘just enough data but no more’.