Rule set sha256:c63def17fac2
GDPR_DATA_MINIMIZATION_001
One rule of the rule set with digest c63def17fac2df12ab70941d8fcb7678e9a670479ea0d6dce87e7ddd4dc96079. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | GDPR_DATA_MINIMIZATION_001 |
|---|---|
| Rule version | ac56042847b1a3bee54372c8015c65389f7cc7fcc9cc08d2741506474d1a38de |
| Provision | Regulation (EU) 2016/679, Article 5(1)(c) ELI: http://data.europa.eu/eli/reg/2016/679/art_5/par_1/pnt_c/oj |
| Approval | Approved Approved by Leo Celis (via agent review per §5.1 amendment v1.1) on 2026-10-22 |
rules/regulations/eu/gdpr_data_minimization.yaml
- Citation
- Regulation (EU) 2016/679 (GDPR), Article 5(1)(c): personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)".
- Condition
- Personal data collection must be adequate, relevant and limited to what is necessary
- Layer 1 detects
- collect, gather or request (also inside a longer word) followed later on the same line by personal or sensitive, a space, then data or information. It matches wording, not meaning: it does not read the purpose or whether the data is adequate, relevant and limited to what is necessary, so it fires on every collection of personal data written in these words, including a minimal one ("We collect only the personal data the delivery needs: name and address."), and it misses collection told in other words. Whether a collection is excessive is judged in Layer 2.
- Condition type
- regex; semantic condition in the file, not run by the engine
- Status in the file
- approved