Which requirement is specified by DM-1 Data Minimization privacy control?

• A. Org take appropriate steps to ensure the collection of PII is consistent with a purpose authorized by law or regulation
• B. Org take reasonable steps to confirm the accuracy of PII
• C. The org disseminates reports to oversight bodies
• D. The org has a privacy incident response plan

Answer: (A)

Data minimization means collecting only what is necessary and ensuring that collection serves a purpose that is authorized by law or regulation. The requirement described—taking steps to ensure the collection of PII is consistent with a purpose authorized by law or regulation—directly enforces that idea by tying data collection to a legitimate, permitted purpose and avoiding unnecessary data. This approach reduces the amount of data stored and processed, lowering risk and simplifying compliance.

The other options point to separate privacy controls: ensuring accuracy pertains to data quality, disseminating reports to oversight bodies relates to governance and transparency, and having a privacy incident response plan concerns how to handle privacy breaches.