In short. GDPR data minimisation requires limiting personal data to what the purpose needs, including when designing AI systems and collecting training data.

Definition: GDPR data minimisation is the requirement in Article 5(1)(c) of the General Data Protection Regulation to ensure personal data are adequate, relevant and limited to what the processing purpose requires. Personal data means information relating to an identified or identifiable person; the requirement applies when collecting and using such information for AI systems.

Key facts

GDPR Article 5 makes minimisation a processing principle and requires the controller, the organisation deciding the purposes and means of processing, to demonstrate compliance.
As of 17 October 2026, CNIL's AI development recommendations require defining the relevant data categories before web collection and immediately deleting irrelevant data collected inadvertently.
CNIL's system design guidance permits large training datasets when their necessity is justified, including through representativeness needs or comparisons using different data volumes.
CNIL's collection and management guidance extends data selection to associated metadata, information describing the data or its collection, and annotations, descriptions assigned to training examples.

The operative provision in Article 5(1)(c) reads:

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

The same regulation connects this requirement to system design. Article 25 requires appropriate technical and organisational measures so that only the personal data necessary for each specific purpose are processed by default. This covers the amount collected, the extent of processing, storage periods and accessibility.

Article 5(1)(e) separately limits how long identifiable data are kept. Consent, listed among the lawful bases in Article 6, operates alongside these requirements.

How does minimisation shape an AI project?

CNIL's AI development recommendations begin with a defined purpose. For a general purpose model, simply stating that the aim is to develop and improve an AI system is too broad: the purpose should identify the system type and technically feasible capabilities.

CNIL's design guidance says to prefer a technique that achieves the same result with less personal data. Where a method without machine learning meets the objective, that method should be preferred.

Selection also concerns the detail within each record. The guidance gives age or an age range as alternatives to a full date of birth when they preserve the information needed for the objective. It recommends small pilot studies to validate technical and data choices, including experiments using fictitious data or data anonymised so that people are no longer identifiable.

How should collection and review work?

For web collection, CNIL's AI development recommendations call for filters or website exclusions to avoid gathering irrelevant categories, particularly sensitive data. This makes the choice of collection sources part of minimisation.

CNIL's collection guidance describes cleaning operations such as removing duplicates and unnecessary fields. Irrelevant training data must be deleted. Associated metadata also need review because collection dates or locations can help identify people.

The same guidance recommends regular dataset analysis: technical developments or changes in the data can make earlier minimisation measures obsolete. Documentation supports traceability of the data used.

FAQ

GDPR Articles 5 and 6 require both compliance with the processing principles and a lawful basis. If you rely on consent, the data still need to be adequate, relevant and limited to the purpose.

Must every AI training dataset be small?

CNIL's design guidance allows large datasets with a justification of necessity. You can assess volume through representativeness requirements, statistical analysis or experiments comparing different volumes.

What happens to training data kept for maintenance?

CNIL's collection guidance limits maintenance retention to necessary data and requires a justified duration. Where prolonged retention supports audits or bias measurement, enhanced security measures accompany it.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer

Key facts

What does the GDPR require?

How does minimisation shape an AI project?

How should collection and review work?

Related terms

FAQ

Does consent allow collecting extra personal data?

Must every AI training dataset be small?

What happens to training data kept for maintenance?

Sources

Test a page and see what to fix first