What is data minimization and how is it applied in Annex F?

• A. Collect only what is necessary; reduces exposure and risk.
• B. Collect as much as possible.
• C. Maintain data forever.
• D. Data minimization is about deleting data after 1 year

Answer: (A)

Data minimization means collecting only what is necessary to achieve a defined purpose. In Annex F, this is put into practice by clearly identifying exactly which data elements are required for a task, avoiding unnecessary data collection, and applying retention and disposal rules so data is kept only as long as it’s needed. This approach reduces exposure and risk because less information is available to be exposed or misused, and it limits the potential impact if a breach occurs. For example, a form would gather only essential fields, and data would be retained only as long as it supports the purpose, with secure deletion when no longer needed. The other ideas—collecting as much data, keeping data forever, or deleting after a fixed period like one year—do not align with minimization and would increase risk.