Skip to content
Step 1 / –
hubThe essentials

The four rules of the GDPR

The GDPR is about one thing: personal data. Around it, it sets out four core rules. In this module and the next two, we work through them one by one. We start with data minimisation.

groupPersonal data
  1. 1Data minimisationthis module
  2. 2Transparency
  3. 3Security
  4. 4Rights of data subjects
flagIntroduction

Data minimisation

The first of the four core rules. The idea is simple: collect as little data as possible. Less data means less risk, for your business and for the data subjects.

targetWhat you will learn in this module
  • check_circleWhat 'strictly necessary' means
  • check_circleWhy every use needs a business purpose and a lawful basis
  • check_circleHow to apply this practically in your own business
menu_bookTheory · 1 of 3

Use only what is strictly necessary

You may only collect personal data that is strictly necessary for the intended business purpose. Less data means less risk for all parties.

targetTied to a business purpose

Every business process that uses personal data must have a documented business purpose. Example: the invoicing process uses payment details to be able to collect a payment. That stops data being gathered without a specific purpose.

menu_bookTheory · 2 of 3

Underpinned by a lawful basis

Every use of personal data also needs a valid GDPR lawful basisThe legal basis you rely on for a processing activity. The GDPR provides six in total; for SMEs these are the four most common.The 6 lawful bases explainedarrow_forward. The four most common:

  • Contract: necessary to perform your contract with the customer.
  • Legal obligation: the law requires you to keep the data.
  • Consent from the data subject: freely given, and equally free to withdraw.
  • Legitimate interests: e.g. promoting similar products. Not valid for special category data.
menu_bookTheory · 3 of 3

In practice: how to approach it

  • Make an inventory of all business processes that use personal data and their purpose.
  • Confirm you only use data that is strictly necessary.
  • Check whether each use has a lawful basis.
  • Talk to your software supplier about removing unnecessary fields from the screen.
infoRemember

Are you collecting data “just in case”? Then you probably lack both a purpose and a lawful basis.

casesExample · 1 of 2

One loyalty card, two processes

You want to give regular customers a discount after 10 purchases, and you also want to wish customers a happy birthday.

Process 1Rewarding regular customers with a discount

Purpose: granting a loyalty discount based on purchases.

check_circleStrictly necessary: name, address, and purchase history. Lawful basis: contract; the sales agreement says you get a discount after x purchases.
casesExample · 2 of 2

Same file, different purpose, different process

Process 2Sending a birthday email

Purpose: sending customers a birthday email.

check_circleStrictly necessary: email, name, and birthday (e.g. 5 May). The birth year is not necessary and should not be collected. Lawful basis: consent or legitimate interests, with an opt-out in the email.

A birthday email like this is a form of Direct marketingCommercial or promotional messages aimed at a person: newsletters, promotions, birthday emails … For this you need a valid lawful basis (consent or legitimate interests) and the recipient must always be able to opt out easily.Direct marketing and the GDPRarrow_forward.

quizPractice · question 1 of 2
infoNot for points, choose the correct answer to continue
"Your software offers a 'gender' field on the loyalty card, but you do not need it for anything. What does data minimisation say?"
Correct: if there is no purpose and no lawful basis, do not collect the data. Ask your software supplier to remove unnecessary fields.
quizPractice · question 2 of 2
"What is true about consent as a lawful basis?"
Correct: consent must be freely given and must be equally free to withdraw. If it is not, the consent is not valid.
summarizeSummary

What you take away from module 3

  • boltCollect as little as possible: only data that is strictly necessary for the purpose.
  • boltEvery process involving personal data has a documented business purpose.
  • boltEvery use relies on a valid lawful basis (contract, legal obligation, consent, or legitimate interests).
  • boltConsent must be freely given and freely withdrawable; legitimate interests does not apply to special category data.
workspace_premiumModule complete

Module 3 complete 🎉

You now know what data minimisation means and how purpose and lawful basis fit together. In module 4 we look at the second rule: transparency.

lock_open 3 of 8 modules

On your way to the “GDPR essentials for SMEs” practice quiz

Complete all 8 modules and try the free practice quiz. The official exam with a certificate of attendance is in the GDPRWise app’s paid plans.

check_circle Modules 1-3 completeradio_button_unchecked Modules 4-8radio_button_unchecked Final exam ≥ 70%
workspace_premium