What does data minimization refer to in terms of information protection?

• A. Collecting as much data as possible
• B. Limiting the amount of personal data collected and stored
• C. Storing data for unlimited timeframes
• D. Shared data amongst departments

Answer: (B)

Data minimization is a key principle in information protection that emphasizes the importance of limiting the collection and retention of personal data to what is necessary for a specific purpose. The correct choice highlights that organizations should only collect and store the minimum amount of personal data required to fulfill a specific business function or comply with legal obligations. This approach helps to mitigate privacy risks, enhances data security, and ensures compliance with regulations like the GDPR, which mandate that personal data should be relevant and limited to what is necessary.

By focusing on restricting the volume of data collected, organizations not only reduce their risk exposure related to data breaches but also foster a culture of responsibility regarding personal data handling. This principle supports the overall goal of protecting sensitive information while balancing the needs of the business.