Data minimization

Data minimization asks a simple question before any collection: do we really need this data, at this level of detail, for this purpose? GDPR Art. 5(1)(c) sets it as a core principle, and the LGPD expresses the same idea as the principle of necessity (Art. 6, III). It applies to what is collected, how much, how precisely, who can access it and how long it is kept.

Minimization does not mean using as little data as possible in absolute terms; it means proportionality to a defined purpose. That is why it depends on purpose limitation: without a clear purpose, nothing can be judged necessary.

In AI work, the principle pushes teams to remove direct identifiers from training sets, aggregate where individual records are not needed, avoid collecting attributes "in case they become useful" and prefer techniques such as pseudonymization or synthetic data. For example, a model that predicts store demand rarely needs customer names or exact birth dates; age bands and postal regions may be enough.