Minimum Data Necessary
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
The entity collects all available data without consideration for necessity or legal basis.Example Strategies
- Acknowledge the mandate.
- Identify Responsibility and Accountability.
- Recognize implementation deadline.
- Informal Consideration and Questioning.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
There's a general understanding that not all data is needed, but no formal policy or controls are in place to limit collection.Example Strategies
- Draft preliminary policy.
- Begin documenting intended uses.
- Begin reviewing forms and other data collection points.
- Review the entity’s most-used form for over-collection.
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
A policy on data minimization exists, but its implementation is informal or inconsistent across departments.Example Strategies
- Formalize policy.
- Standardize Forms.
- Mandatory training re data minimization.
- All forms and manners of personal data collection are reviewed for data necessity and legal basis for collection.
- Implement an entity-wide policy to process only necessary data.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
Formal policies and technical controls are consistently applied to ensure that only the minimum amount of personal data "reasonably necessary to efficiently achieve a specified purpose" is collected and processed (Utah Code § 63A-19-401(2)(c)).Example Strategies
- Implement metrics.
- Conduct internal reviews.
- Report on progress.
- Track "Data Retirement" metrics as a key performance indicator.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity conducts regular data minimization audits and uses metrics to identify areas where data collection can be further reduced without impacting service delivery.Example Strategies
- Entity Integration
- Advanced privacy risk assessments
- Continuous improvement
- Deploy automated "Data Minimization" filters.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
Data minimization principles are built into the design of new systems and processes, and employees are actively trained on identifying and challenging unnecessary data collection.