The privacy principle of collecting only the personal information that is strictly necessary for a specific, identified purpose.
Data minimization reduces privacy risk by limiting the amount of personal information held. Every piece of personal data is a liability: it can be breached, misused, or subject to access requests. Collecting less data means less risk. PIPEDA requires that collection be limited to what is necessary for the identified purpose.