According to our article on the data minimization principle, "Article 5(1)(c) of the GDPR defines data minimization by saying that personal data should be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” In other words, businesses should only collect essential information and only keep it as long as it’s actually needed."