Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
A core GDPR principle (Article 5(1)(c)) requiring that personal data be adequate, relevant and limited to what is necessary for the purposes for which they are processed. For AI systems, data minimization means not feeding models unnecessary personal attributes, not logging full personal records in inference pipelines indefinitely, anonymizing or pseudonymizing data at the earliest feasible stage, and using synthetic data for development and testing where full personal records are not required. Data minimization is both a legal obligation and an effective risk reduction strategy: data you do not collect cannot be breached, leaked, or misused.
Why this matters for your team
The most common GDPR gap in AI projects is over-collection: feeding models more personal attributes than the task requires. Before any AI deployment that touches personal data, audit the feature set: which fields actually improve the model, and which are just there because they were available? Minimize at the data pipeline level.
A churn prediction model is retrained to use product usage patterns and support ticket frequency — removing age, location, and job title from the feature set after analysis showed they added marginal predictive value but created unnecessary GDPR data minimization risk.