Which statement best describes data minimization under Annex B data protection?

• A. Collect all data for future unknown uses.
• B. Collect only data necessary for a defined purpose; reduces risk and exposure.
• C. Collect data for marketing purposes regardless of necessity.
• D. Data minimization means never collecting any data.

Answer: (B)

Data minimization is the practice of collecting only what is strictly needed for a defined purpose, and then limiting how long you keep and use that data. This approach reduces privacy risk and exposure because there’s less data to protect, fewer chances for it to be misused or breached, and it keeps processing proportional to the stated aim. In real terms, you gather just what you need for the task at hand—for example, a signup might require only a name and email, not extra details. The idea is to avoid collecting data for unknown future uses or for marketing if it isn’t necessary, and never collecting data ignores legitimate needs for functioning services.