What does GDPR regulate, and which principle relates to data minimization?

• A. US data privacy law; principle of data minimization requires collecting only necessary data.
• B. EU data protection regulation; principle of data minimization requires collecting only necessary data and limiting retention.
• C. A corporate policy; data sharing.
• D. None.

Answer: (B)

GDPR governs the processing of personal data within the EU. It’s an EU data protection regulation that applies to how controllers and processors handle individuals’ data, regardless of where the data processor is located if EU residents’ data is involved. One of its principles is data minimization: you should collect only the data that is necessary for the stated purpose. In practice this also aligns with limiting how long you keep that data, so retention is managed to avoid keeping information longer than needed. The other options describe laws or policies that aren’t GDPR, so they don’t fit.