Data Minimisation

Under the Data Protection Act 2018, an organisation may collect only the personal data it actually needs for the purpose it has stated. The data must be adequate (enough to do the task), relevant (connected to that task) and necessary (no more than the task requires).

A worked example

A community choir is booking a coach trip. Its booking form asks each singer for their name, age, emergency contact and lunch choice. Those details are adequate and relevant: the choir can reach someone in an emergency and order the right number of lunches. The form should not ask for each singer's favourite film or their exam results. Even though this is personal data, it is not necessary for booking the trip, and collecting it just in case it might be useful later is prohibited.

Why collecting less matters

Every extra field gives the organisation more personal data to look after, so there is more to lose or to leak. It also goes beyond what the singer was told the data would be used for, which the Act prohibits. If a detail is not needed for the stated purpose, the organisation should not collect it, so a form should ask only for fields that someone can justify.