Question:According to theprinciple of data minimization, data must be:

UnderArticle 5(1)(c) of GDPR, data minimization requires thatpersonal data must be adequate, relevant, and limited to what is necessaryfor its intended purpose.

Option C is correctbecause itdirectly reflects the GDPR’s data minimization principle.

Option A is incorrectbecausestorage limitation is a separate principle under Article 5(1)(e).

Option B is incorrectbecausepurpose limitation (Article 5(1)(b)) is separate from data minimization.

Option D is incorrectbecauseGDPR does not specify a fixed retention period (e.g., five years)—retention should be based on necessity.

References:

GDPR Article 5(1)(c)(Data minimization principle)

Recital 39(Controllers must collect only necessary data)