Data Minimization — Necessary Data Principle for AI Systems

Definition

Data minimization is the data protection principle, enshrined in GDPR Article 5(1)(c), that personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Applied to AI systems, it requires that training datasets, inference pipelines, and data storage include only the personal data that is strictly necessary for the AI system’s intended function — not the maximum available, not what might be useful in future, but what is genuinely required for the defined purpose.

In AI development contexts, data minimization creates specific operational requirements: training data curation should exclude personal data attributes not required for the model’s purpose; features used in inference should be limited to those with documented relevance to the prediction target; personal data retention in model outputs and logs should be limited to the minimum period necessary; and data subjects’ rights — including the right to erasure — must be manageable despite the technical complexity of removing data from trained models.

The EU AI Act’s Article 10 reinforces data minimization for high-risk AI systems, requiring that training, validation, and testing data be subject to appropriate data governance practices that include, where appropriate, the consideration of privacy and personal data protection.

Why it matters operationally

Data minimization matters for AI because AI development has historically followed the opposite principle: more data is better. Larger training datasets generally produce more capable models, creating a structural incentive to collect and retain as much data as possible. Data minimization requires organizations to deliberately resist this incentive and make documented decisions about what data is necessary for each AI system’s purpose.

The practical governance implication is that data minimization must be applied at the design stage. Once a model has been trained on unnecessary personal data, the data is embedded in the model’s parameters and cannot be fully removed without retraining. Organizations that collect data first and apply minimization later consistently find that the minimization exercise is either incomplete or requires significant rework. Privacy by design, applied from the start, is the only effective implementation of data minimization for AI.

Regulatory framework

Framework	Data minimization requirements
GDPR — Art. 5(1)(c)	Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Data minimization principle.
EU AI Act — Art. 10	Data governance practices for high-risk systems must include consideration of privacy and personal data protection, including minimization where appropriate.
ISO/IEC 27701	The privacy management system includes data minimization controls as part of controller requirements.
ISO/IEC 42001	Annex A controls on training data include purpose limitation and minimization as part of AI data governance.

How Zertia evaluates it

Zertia evaluates data minimization through ISO/IEC 27701 certification — which includes assessment of whether the organization has documented and implemented data minimization controls as part of its Privacy Information Management System. ISO/IEC 42001 certification evaluates whether data governance controls for AI systems include purpose limitation and data minimization principles.

[ISO 27701 Certification] · ISO 42001 Certification