← CCPA/CPRA · Business obligations
1798.100(c) — Purpose limitation and data minimisation
Requirement
Collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to achieve the purposes for which it was collected or processed, or for another disclosed purpose compatible with the context of collection, and not further processed incompatibly.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.5(1)(c) | Data minimisation | data-minimisation |
| GDPR | Art.5(1)(b) | Purpose limitation | data-minimisation |
| GDPR | Art.25 | Data protection by design and by default | data-minimisation |
| PCI DSS 4.0.1 | 3.3 | Sensitive authentication data is not stored after authorisation | data-minimisation |
| COPPA | 312.7 | No conditioning participation on excess data | data-minimisation |
| NDPA 2023 | s.24(2)-(3) | Technical and organisational measures, accountability and privacy by design | data-minimisation |
| SOC 2 | P4.1 | Use, retention and disposal of personal information (P4.1–P4.3) | data-minimisation |
| ISO 27001 | A.5.34 | Privacy and protection of personally identifiable information | data-minimisation |