Which of the following practices BEST indicates an organization follows the data minimization principle?

Question

Options

• AIt states that personal data should be adequate, relevant, and limited to what is necessary in
• BData is encrypted before storage.
• CData is only accessible on a need-to-know basis.
• DData is regularly reviewed tor its relevance

• B
  5% (2)
• C
  3% (1)
• D
  92% (34)

Explanation

Data minimization means collecting and retaining only the personal data that is necessary for the specified purpose. Regularly reviewing data for its relevance is the practice that operationalizes this principle - it ensures that data no longer needed is identified and removed. Option A describes the definition or policy statement of data minimization, not a practice that demonstrates it. Option B (encrypting data before storage) addresses confidentiality and security, not minimization. Option C (need-to-know access) relates to access control and the principle of least privilege, not the quantity or relevance of data collected. Only ongoing relevance reviews confirm that the organization is actively limiting data to what is necessary.

No community discussion yet for this question.