Which of the following practices BEST indicates an organization follows the data minimization principle?

Question

Options

• AData is encrypted before storage.
• BData is regularly reviewed for its relevance.
• CData is only accessible on a need-to-know basis.
• DData is pseudonymized when being backed up.

• A
  2% (1)
• B
  91% (43)
• C
  4% (2)
• D
  2% (1)

Explanation

Data minimization is the principle of collecting and retaining only personal data that is necessary for a specified purpose. Regularly reviewing data for relevance directly reflects this principle by actively identifying and removing data that is no longer needed. Encryption (A) is a security control unrelated to minimization. Access restriction on a need-to-know basis (C) implements access control, not minimization-the data still exists in full. Pseudonymization during backup (D) is a de-identification technique that does not reduce the volume of data held. Only option B demonstrates an active practice of limiting retained data to what is necessary.

No community discussion yet for this question.