What is the data minimization principle in GDPR and why does it matter in cybercrime investigations?

• A. Collect only what's necessary; it limits exposure and helps protect privacy while still enabling investigation.
• B. Collect as much data as possible to ensure comprehensive evidence.
• C. Data minimization means deleting all data after 24 hours.
• D. Data minimization refers to minimizing the number of investigators.

Answer: (A)

Data minimization in GDPR means collecting only what is necessary to achieve a specific, legitimate purpose. In cybercrime investigations this means focusing on data that is directly relevant to the case and proportionate to the investigative objective, rather than grabbing large volumes of information. This approach reduces privacy risks, limits exposure in the event of a breach, and helps demonstrate compliance with privacy protections while still enabling effective investigation. It also aligns with the broader GDPR ideas of purpose limitation and proportionality, ensuring that data use is justified and bounded.

The best answer captures this balance: collect only what's necessary; it limits exposure and helps protect privacy while still enabling investigation.

Collecting everything would violate the necessity and proportionality principles. Deleting all data after a fixed short period is a retention policy, not the principle itself. Minimizing the number of investigators has no relation to data handling under GDPR.