GDPR Data Minimization: Article 5 Rules, Retention, and Penalties

GDPR data minimization requires your organization to collect only the personal data genuinely needed for a specific, stated purpose, to keep it only as long as that purpose lasts, and to be able to prove both on demand. The rule lives in Article 5(1)(c) of the General Data Protection Regulation, which says personal data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.”¹ Collecting information “just in case” is not allowed. Every field on every form needs a reason.

The Three-Part Test in Article 5(1)(c)

Each piece of personal data you hold has to pass three checks.

Adequate means you have enough to do the job. A shipping company that captures a street address without a postal code has inadequate data because it cannot complete the delivery.

Relevant means every field has a logical connection to what you are trying to do. If you only need to know someone is over eighteen, collecting a full date of birth may fail this test when a yes-or-no age check would work.

Limited to what is necessary means nothing beyond what the specific task demands. Recital 39 puts the bar higher than many controllers assume: personal data should only be processed when the purpose “could not reasonably be fulfilled by other means.”² The right question is not “could this data be useful?” but “could we do this without collecting it at all?”

Purpose Defines What “Necessary” Means

You cannot judge necessity without a purpose to measure against. Article 5(1)(b) requires that personal data be collected for “specified, explicit and legitimate purposes” and not reused in ways incompatible with them.¹ The stated purpose draws the box; minimization keeps everything else out.

That constraint is where many organizations get caught. If you collect email addresses to send a newsletter, that justification does not stretch to also grabbing a phone number or a postal address. Each additional data point needs its own documented, legitimate purpose. Bundling everything under a vague heading like “to improve our services” will not satisfy a regulator.

When you rely on consent as the legal basis for processing, the consent itself has to be granular. Users should be able to agree to some processing and not others, rather than facing a single “I agree” checkbox that covers everything. Consent is presumed not to be freely given when it is bundled as a condition of receiving a service and the processing is not needed to deliver that service.³

Keeping Data Only as Long as You Need It

Minimization does not end at collection. Article 5(1)(e) requires that personal data be kept “for no longer than is necessary for the purposes for which the personal data are processed.”¹ Data that was lawful when collected becomes a violation the moment its purpose expires and it stays on your servers.

The GDPR does not hand you a retention schedule. You have to define, document, and justify your own timelines for each processing activity. Some external laws force longer periods: tax records typically must be kept for six or seven years, and employment records often need to be held for several years after the relationship ends. Outside those legal mandates, the default expectation is deletion or anonymization once the purpose is fulfilled. Recital 39 asks controllers to set specific erasure deadlines or schedule periodic reviews of whether stored data is still needed.²

Anonymization and pseudonymization are not the same thing, and confusing them is expensive. Pseudonymization replaces direct identifiers with codes but keeps re-identification possible if someone has the key. Under Recital 26, pseudonymized data is still personal data and stays fully within the GDPR.⁴ Truly anonymized data, where re-identification is irreversibly impossible, falls outside the regulation and can be retained indefinitely. Treating pseudonymized data as if it were anonymous is a mistake regulators regularly flag.

Building Minimization Into Your Systems

Article 25 turns the principle into an engineering obligation. Controllers must implement “appropriate technical and organisational measures, such as pseudonymisation,” to build data minimization into the processing itself rather than bolt it on later.⁵

The harder part is Article 25(2), the “by default” requirement. Your systems must be configured so that only the personal data necessary for each specific purpose is processed as a baseline, covering the amount collected, the extent of processing, the storage period, and who can access it.⁵ Users should not have to dig through settings to restrict sharing. The most privacy-protective configuration must be where every user starts.

The European Data Protection Board has stressed that these obligations apply before processing begins, at the point when you first design a new system, and continue through its life via regular effectiveness reviews.⁶ Skipping minimization at the design stage is itself a violation, even if no breach ever occurs.

Sensitive Data Faces a Stricter Standard

Article 9 covers special categories of personal data: racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation. Processing this information is prohibited by default.⁷

The prohibition lifts only under specific exceptions, most commonly the individual’s explicit consent or a substantial public interest grounded in EU or member state law.⁷ Even when an exception applies, minimization tightens. You have to show not only that the data is relevant but that processing it is genuinely indispensable and that no less sensitive alternative would work.

Proving Compliance: Records and Impact Assessments

Article 5(2) puts the burden on you: the controller is responsible for compliance and must be able to demonstrate it.¹ Saying “we only collect what we need” carries no weight without documentation.

Article 30 spells out the minimum. Controllers must maintain written records of processing activities that include the purposes of processing, the categories of personal data collected, the categories of recipients, and, where possible, the time limits for erasure. Those records have to be available to the supervisory authority on request.⁸ In practice, that means a data inventory that maps every processing activity to a purpose and a retention period. If you cannot explain why a particular field exists in your database and when it will be deleted, you have a minimization problem.

For higher-risk processing, Article 35 adds the Data Protection Impact Assessment. A DPIA is required before any processing likely to result in a high risk to individuals, including automated profiling that produces legal effects, large-scale processing of Article 9 sensitive data, and systematic monitoring of publicly accessible areas.⁹ The assessment forces you to identify and reduce privacy risks before a new system goes live.

When Individuals Enforce Minimization Themselves

Even if your retention policies fall short, individuals can push back directly. Article 17 gives every data subject the right to request erasure of their personal data, and you must comply “without undue delay” when the data is no longer necessary for its original purpose, when the person withdraws consent, or when processing was unlawful.¹⁰

The first ground mirrors the minimization principle exactly. If you kept information past the point of necessity, the individual does not need to wait for a regulator. They can demand deletion themselves. Organizations without a clear retention schedule often discover their gaps when erasure requests arrive and no one can determine what should already have been deleted.

What Non-Compliance Costs

Violating data minimization triggers the GDPR’s top penalty tier. Article 83(5) groups breaches of the Article 5 core principles with violations of data subject rights and unlawful international transfers, exposing controllers to fines of up to €20 million or 4% of total worldwide annual turnover from the preceding financial year, whichever is greater.¹¹

Supervisory authorities have used those powers repeatedly. The Irish Data Protection Commission fined Meta €251 million, with €110 million of that specifically for failing to process only necessary data by default. The French CNIL fined Free Mobile €27 million in early 2026 after finding the company had kept millions of records from former subscribers without justification and had no process to sort, review, or delete data once its purpose had expired.¹² The Dutch data protection authority fined Clearview AI €30.5 million in 2024 for scraping facial images from the internet without a legal basis and processing biometric data in violation of Article 9.¹³

The common thread is a pattern regulators clearly punish: organizations collecting or holding far more data than any legitimate purpose could justify, without documentation of why the data exists or when it will be deleted. Fines scale with the severity of the violation, the number of individuals affected, and whether the controller acted negligently or deliberately.¹¹ You do not need to suffer a breach to face these penalties. Holding excessive data is the violation.

1
General Data Protection Regulation (GDPR). General Data Protection Regulation – Art. 5 GDPR Principles Relating to Processing of Personal Data
2
General Data Protection Regulation (GDPR). Recital 39 – Principles of Data Processing
3
Information Commissioner’s Office (ICO). What Is Valid Consent?
4
General Data Protection Regulation (GDPR). Recital 26 – Not Applicable to Anonymous Data
5
General Data Protection Regulation (GDPR). General Data Protection Regulation Article 25 – Data Protection by Design and by Default
6
European Data Protection Board. Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
7
General Data Protection Regulation (GDPR). Art. 9 GDPR Processing of Special Categories of Personal Data
8
General Data Protection Regulation (GDPR). Records of Processing Activities
9
General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment
10
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (‘Right to Be Forgotten’)
11
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
12
CNIL. Data Breach: FREE MOBILE and FREE Fined 42 Million
13
European Data Protection Board. Dutch Supervisory Authority Imposes a Fine on Clearview Because of Illegal Data