Which practice describes data minimization in privacy handling?

• A. Collect only what is necessary for the stated purpose.
• B. Collect additional PII just in case it may be useful.
• C. Store data for an indefinite period.
• D. Share data with external vendors without a data sharing agreement.

Answer: (A)

Data minimization centers on collecting only what is strictly needed to achieve the stated purpose, and using and retaining only that data for as long as necessary. This limits privacy risk because fewer data points mean fewer opportunities for misuse or breach, and it keeps practices aligned with the purpose of collection. The approach described reflects this idea by collecting only what is necessary for the stated purpose. Other ideas don’t fit: gathering additional personal information just in case increases risk and storage burden; keeping data indefinitely violates the principle of limiting retention; sharing data with external vendors without a data sharing agreement creates governance gaps and unnecessary exposure.