Requirement
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
minimis…minimiz…only collectnecessarylimited to whatadequate and relevant
Supporting terms — specificity signals
field-level reviewno unnecessaryjustificationoptional fieldavoid collecting
Contradiction markers
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
collect as much as possible
collect everything
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| CCPA/CPRA | 1798.100(c) | Purpose limitation and data minimisation | data-minimisation |
| PCI DSS 4.0.1 | 3.3 | Sensitive authentication data is not stored after authorisation | data-minimisation |
| COPPA | 312.7 | No conditioning participation on excess data | data-minimisation |
| NDPA 2023 | s.24(2)-(3) | Technical and organisational measures, accountability and privacy by design | data-minimisation |
| SOC 2 | P4.1 | Use, retention and disposal of personal information (P4.1–P4.3) | data-minimisation |
| ISO 27001 | A.5.34 | Privacy and protection of personally identifiable information | data-minimisation |
| PCI DSS 4.0.1 | 3.2 | Minimise storage of account data | data-minimisation |
| NDPA 2023 | s.24 | Principles of data processing | data-minimisation |