Which privacy principle requires collecting only data that is necessary?

• A. Data retention
• B. Data accuracy
• C. Consent management
• D. Data minimization

Answer: (D)

Data minimization means collecting only what is necessary to fulfill a defined purpose. This keeps the data footprint small, reduces privacy risk, and makes compliance simpler. For example, if you only need an email address to create an account, you should avoid collecting or storing extra details like birthdate or home address.

Data retention is about how long you keep data, not how much you collect. Data accuracy focuses on keeping information correct and up-to-date. Consent management concerns obtaining permission to process data, which is related but does not by itself determine the amount of data to collect. So the principle that directly addresses collecting only what is needed is data minimization.