Data minimization means collecting and processing only the personal data that is necessary for a specific and legitimate purpose.
This principle reduces privacy risk by limiting the amount, scope, and retention of personally identifiable information (PII).