Which practice demonstrates data minimization when handling PII during an incident?

• A. Collect additional PII just in case it may be useful.
• B. Store data for an indefinite period.
• C. Collect only what is necessary for the stated purpose.
• D. Share data with external vendors without a data sharing agreement.

Answer: (C)

Data minimization means gathering only the information that is strictly needed for the stated purpose, especially when handling PII during an incident. This limits the data at risk, speeds response, and helps meet privacy and regulatory expectations. Collecting extra PII just in case it may be useful increases exposure and complicates handling. Storing data indefinitely extends the window of risk and makes it harder to delete when no longer needed. Sharing data with external vendors without a formal data sharing agreement creates governance gaps and potential privacy violations. The best practice is to collect only what is necessary for the stated purpose.