# Data Minimization Standards and Regulatory References

## Primary GDPR Articles

### Article 5(1)(c) — Data Minimization Principle
Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

### Article 25(1) — Data Protection by Design
The controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing.

### Article 25(2) — Data Protection by Default
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.

### Article 4(5) — Definition of Pseudonymisation
The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

### Article 32(1)(a) — Security of Processing
The pseudonymisation and encryption of personal data as appropriate technical measures to ensure a level of security appropriate to the risk.

## Supporting Recitals

### Recital 26 — Anonymous Information
The principles of data protection should not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

### Recital 78 — Technical and Organisational Measures
Measures could consist, inter alia, of minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing.

## Regulatory Guidance

### EDPB Guidelines 4/2019 on Article 25
Adopted 20 October 2020. Defines data minimization across four dimensions: amount of data collected, extent of processing, period of storage, and accessibility. Requires controllers to identify the minimum amount of personal data needed to fulfill their purpose.

### ENISA Pseudonymisation Techniques Report (November 2019)
Provides technical analysis of pseudonymisation techniques including counter mapping, random number generators, cryptographic hash functions (with and without key/salt), message authentication codes (HMAC), and encryption-based approaches. Evaluates techniques against robustness, scalability, and recovery criteria.

### Article 29 Working Party Opinion 05/2014 (WP216)
Defines three risk criteria for assessing anonymization: singling out, linkability, and inference. Evaluates techniques including randomization (noise addition, permutation, differential privacy) and generalization (k-anonymity, l-diversity, t-closeness).

## Technical Standards

### NIST SP 800-188 — De-Identifying Government Datasets (December 2016)
Provides guidance on de-identification methodologies applicable to structured datasets, including suppression, generalization, swapping, and noise injection.

### ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Terminology and Classification
Classifies de-identification techniques into statistical disclosure control, cryptographic techniques, and suppression-based methods.

### IEEE 7002-2022 — Data Privacy Process
Standard for managing data privacy throughout the system life cycle, incorporating data minimization as a core design principle.