Map the Purpose Before the Fields
Identify the stated purpose before deciding which personal data fields are necessary.
Minimization begins with a sentence, not a database setting. If your team cannot finish the sentence "We need this data in order to...", the field is already suspect. Purpose first The purpose is the job the processing is meant to accomplish. Under GDPR logic, the purpose must be specific enough that a person can understand what will happen. "Improve experience" is usually too broad. "Send the requested webinar link" is specific enough to test fields against. Necessity next Necessary does not mean convenient, nice to have, or possibly useful later. Necessary means the purpose cannot be properly fulfilled without it,…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in