A privacy-by-design principle holding that systems should collect only the minimum data necessary for a specified purpose, retain it only for as long as necessary, and not repurpose it for other ends. Data minimization is a core principle of the GDPR and a counterweight to the "collect everything" l