In data privacy, what should be the scope of data collection?

• A. Collect only data necessary for the specific purpose.
• B. Collect data for every possible use.
• C. Never collect data.
• D. Share data widely with withholding.

Answer: (A)

Data minimization is the practice of collecting only information that is strictly necessary to achieve a stated, legitimate purpose. This keeps privacy risk low, makes data governance easier, and helps meet legal and ethical privacy expectations. When you define what data to collect, start with the specific purpose and include only the data elements essential to that purpose. For example, if the goal is to verify a user’s identity, you might collect a username and password or a minimal biometric factor—nothing more unless additional data is truly needed to fulfill the purpose. Limiting collection also reduces the potential impact of a data breach and makes it easier to comply with rights like access or erasure, since there’s less data to manage and protect.

Collecting data for every possible use would blow up privacy risk and complexity, since more data means more to protect and more opportunities for misuse. Saying never to collect data is impractical for most services that need some information to function. And sharing data widely without a clear, purpose-based need undermines privacy and consent, which goes against core data-protection principles.