Which of the following is NOT a data minimization practice?

• A. Using data only for specified purposes
• B. Periodically reviewing data holdings to delete unnecessary data
• C. Reducing data collection to the minimum necessary
• D. Encrypting data for protection

Answer: (D)

Data minimization means collecting only what you actually need, using it only for the purposes you’ve specified, and regularly reviewing and deleting data that isn’t necessary. Limiting data collection to the minimum and using data only for defined purposes are direct reflections of this idea, and periodic reviews to remove unnecessary data also support it. Encrypting data for protection, on the other hand, is about safeguarding data’s confidentiality—it's a security measure that protects data you already have, not about reducing how much you collect or retain. It’s valuable, but it doesn’t minimize data itself.