What Is Data Minimization?

Data minimization is the privacy principle, codified directly into GDPR, that an organization should only collect the personal data actually necessary for a specific, stated purpose, and nothing more. It's a design constraint on what a data layer or tag should capture in the first place, not just a rule about how captured data is later handled.

Data minimization is often treated as a legal checkbox rather than an engineering practice, but it’s really the latter: a Data Layer event for a newsletter signup shouldn’t also push a customer’s full address if the form never asked for one. The principle cuts against a common default in analytics implementations: capturing everything available ‘just in case.’ Auditing for it means checking what’s actually collected against what’s actually needed, exactly the kind of gap Payload Inspection surfaces.