Proportionality (data minimization)

Key References:

• Art. 5(1)(c)
• Recital 39

Art. 5

1. Personal data shall be:

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

Recital 39

• ⁷ The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. 
• ⁸ This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. 
• ⁹ Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. 
• ¹⁰ In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.