1798.100(c) Data Minimisation, Necessity and Proportionality
A business's collection, use, retention and sharing of a consumer's personal information must be reasonably necessary and proportionate to achieve the purposes for which it was collected or processed, or for another disc
5
artefacts
0
held by a system
4
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Record of processing showing, per data element, the purpose it was collected for · Data governance / DLP tooling
- Documented necessity and proportionality assessment for each collection purpose · Data governance / DLP tooling
- Evidence that elements failing that assessment were removed from collection forms, SDKs, log schemas and vendor feeds · SIEM / log platform
- Approval record showing a new use was assessed before it went live · Data governance / DLP tooling
governing documentDocuments that govern the control
- Compatibility analysis for any secondary use, referencing the context of collection · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- A record of processing that lists what is collected but never asks whether each element is necessary for the stated purpose
- Necessity assessed once at launch and never revisited as the product changed
- Analytics, session replay and advertising SDKs collecting far more than the disclosed purpose supports, with no owner
- Secondary use justified by a broadly worded privacy policy rather than by compatibility with the context in which the data was actually collected
- Retention schedules that satisfy the retention limb while collection stays unminimised, which does not cure this requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet