What is data minimisation?

Data minimisation is the principle of collecting only the personal data you actually need for a stated purpose — and no more. If the job needs a phone number, you don’t also demand an address, a date of birth, and an ID copy.

Educational resource only — not legal advice.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), consent — and the collection it authorises — is limited to the data the purpose genuinely requires. Over-collecting “just in case” isn’t allowed: each field you ask for should tie to the purpose you’ve stated. Collecting less also means less to secure and less to lose in a breach.

Why it matters to you. For a business, minimisation is both a duty and a risk-reducer — you can’t be breached out of data you never collected. For an individual, it’s why a service shouldn’t demand information it has no real need for.

What it is not. Minimisation doesn’t mean collecting nothing — it means collecting only what the stated purpose needs.