GDPR

GDPR and the Data Minimisation Principle

by Howard Freeman

What does the “data minimisation” principle mean? It states that a data controller should limit the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose. It also means that this data must only be retained for as long as it is required to fulfil that purpose. Many businesses fail to understand this so we asked Howard Freeman to explain this simple, yet important principle, of the GDPR.

GDPR Data Minimisation Principle

What are you collecting and why?

Many businesses collect high volumes of data. As such, there is an important need to revisit the data minimisation principle. This means examining and clearing out data you no longer need, or have a legal basis for keeping.

Cleaning up your data

When adopting the GDPR or improving your compliance, a very good place to start is cleansing your data. However, many businesses have data that will have been acquired from a wide variety of sources. This data could have been acquired from third parties, through acquisition or purchased. In most cases, there is little information about the source of this data. Record this on your Data Asset Register. Again, such registers are rare when they shouldn’t be! You are not compliant with the regulation without one!

Cleansing Checklist

  1. Delete data when no longer needed – establish a data retention policy and procedure.
  2. Ensure your people are gathering data they do not need, training can help.
  3. The collection and storage of data should be understood. A data management policy will help with this.
  4. Deduplicate your methods of data collection – ensure there is a responsible person for this activity.
  5. Ensure all mass communication emails have an unsubscribe option with a link to your CRM.
  6. Remove out of date, or inaccurate data. You must not use inaccurate data.
  7. Be ruthless – you cannot delete too much data if you genuinely don’t need it. However, you must keep a record of you deletion activity with your Data Deletion Register.

Data Retention Policy

Your business must have a policy in place that dictates how your store, and ultimately dispose of any data. Disposal of data will be recorded on a suitable register.

A Data Asset Register not only shows the source of data but also your legal basis for processing. You must have a legal basis for processing and there must be a justifiable business reason behind this. However, you must be clear on your intended business purpose. This helps justify your legal basis for processing. More details about this can be found in our article on the GDPR purpose limitation. The data minimisation principle applies as it demands that data no longer required must be disposed of.

Data retention will also include data held in backups. Whilst many backups will overwrite older versions, others keep individual records of specified periods such as days, weeks or longer. This must be considered when recording data deletion.

Received Data

If you are processing data on behalf of a data controller, you will need to be provided with a Data Processing Agreement. Once the processing contract has ended, the DAP will oblige you to return all data passed to you. In reality, this means deletion. The contract should specify that any copies must be deleted.

Therefore, if you are not sure how long you should keep data or what minimisation means to your business, please call us today on 03333 22 1011 or contact us.