What is data minimisation in AI?
Privacy, security and identity
Data minimisation in AI means using only the personal data that is adequate, relevant and necessary for a specific purpose across collection, training, inference and retention. It is not a ban on using data. It is a design discipline that asks what you genuinely need, what you can remove, and when you should delete or transform it.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 8 June 2026
What this means
Data minimisation in AI means identifying the minimum personal data needed for a clear purpose, then using only that data across collection, training, inference, storage and deletion. The ICO quotes the UK GDPR standard as data that is adequate, relevant and limited to what is necessary. The principle is not anti-AI and it is not a rule that says you can use no personal data. It is a rule against using more than you need.
In practical terms, minimisation asks a workflow-first set of questions: what problem are we solving, which fields are genuinely needed, which ones can be dropped, transformed or kept local, and when does the data stop being necessary? The ICO says this assessment is always case specific.
Why it matters
It matters because AI systems often increase the amount of data copied, shared, stored and reused across teams, suppliers and environments. The ICO notes that AI can exacerbate known security risks and make them harder to manage. If you collect or retain unnecessary personal data, you enlarge the privacy, security and compliance exposure without a clear business justification.
Minimisation also reduces the consequences if something goes wrong. ICO guidance highlights privacy attacks such as model inversion and membership inference, which can reveal whether someone was in training data or expose additional personal information. Using less data, and avoiding unnecessary retention, narrows that attack surface.
How it works
A practical minimisation process usually starts by mapping where personal data is used in training and inference. The ICO then recommends assessing which features are actually relevant for the purpose, using feature selection rather than assuming every available field should be kept. It also recommends considering privacy-enhancing approaches such as perturbation, synthetic data, federated learning, local inference and privacy-preserving query methods.
The control does not stop at model design. The ICO says minimisation should be considered from the design phase and through procurement due diligence, and that retention should be limited so training data is deleted when it is no longer needed. If a model only needs the last 12 months of data, the retention policy should say so and enforce deletion.
Examples
In a credit risk workflow, a team might start with many financial and demographic variables, but the ICO says not all features in a dataset will necessarily be relevant. A minimisation review asks which variables are justified for the purpose and removes those that are not materially needed.
In mobile text prediction, the ICO gives examples of privacy-enhancing alternatives such as adding noise and federated learning, so systems can learn useful aggregate patterns without centralising every user's raw keystrokes. In medical research, the same logic can support analysis across patient databases without pooling raw training data in one place, though re-identification risk still has to be assessed.
Common misunderstandings
A common misunderstanding is that more data is always better. The ICO recognises that extra data can improve statistical accuracy, but it says you should still use fewer data points or fewer people if that is enough for the purpose. Collecting personal data on the off-chance it might be useful later is not justified.
Another misunderstanding is that pseudonymisation, feature vectors or synthetic data automatically remove data protection obligations. The ICO is clear that pseudonymised data remains personal data, converted formats can still be identifiable in context, and synthetic data can still leak information about real people if poorly constructed.
Risks and boundaries
Minimisation is not a one-click privacy setting. Some privacy-enhancing techniques reduce utility, accuracy or realism, and some still create re-identification risks. The ICO notes that federated learning lowers the need to share raw data, but gradients can still reveal personal information. Synthetic data may also be too unrealistic to be useful if you push it too far.
There is also a boundary between minimisation and anonymisation. The ICO says pseudonymisation is a risk-reduction technique, not an automatic exit from data protection law. If you still have identifiable personal data anywhere in the chain, the usual obligations remain.
What to do next
Run a feature and retention review on one live workflow this week. List every field used for collection, prompts, training, inference and storage. Mark each one as necessary, optional or unjustified. Then decide what can be dropped, transformed, kept locally, replaced with synthetic data, or deleted on a clear schedule. This creates a practical least-data baseline instead of a vague privacy promise.
Have a question or a suggestion, or want to understand how we research and review these guides? Read about our editorial standards and how to reach us.
FAQs
Does data minimisation mean we cannot use personal data in AI?
No. The ICO says the principle does not mean process no personal data. It means process only the personal data you need for your purpose.
Can we keep extra fields in case they help later?
Usually not. The ICO says you must not collect personal data on the off-chance that it might be useful in the future unless you can justify a foreseeable need.
Is synthetic data automatically outside data protection law?
Only to the extent that it cannot be related to identifiable living individuals. The real data used to create it may still be regulated, and badly designed synthetic data can still permit inference about real people.
Does federated learning solve privacy by itself?
No. It reduces the need to share raw training data, but the ICO says gradients can still reveal personal information and re-identification risk still needs assessment.
When should training data be deleted?
When it is no longer needed for the stated purpose. The ICO says retention should reflect real need and gives the example of deleting data older than 12 months where only the last 12 months are required.