What does data minimization mean in privacy protection, and how should it be applied?

• A. Collect data for potential future use.
• B. Collect only data strictly necessary for the stated purpose; limit access, and retain only as long as needed.
• C. Share data with third parties without consent.
• D. Retain data indefinitely.

Answer: (B)

Data minimization means collecting only what is strictly needed to fulfill a stated purpose, restricting who can access that data, and keeping it only for as long as it’s necessary. In practice, you define the purpose first, gather only the data that directly supports that purpose, enforce access controls so only authorized people can see it, and set a retention period so data is deleted or anonymized when it’s no longer needed. This approach reduces risk, improves privacy protections, and supports compliance with privacy laws.

The best answer captures all three aspects: only what’s strictly necessary for the stated purpose, limited access, and retention only as long as needed. The other options run counter to this idea: collecting for potential future use expands what’s gathered; sharing without consent bypasses user control; and keeping data indefinitely eliminates the necessary retention limits.