1. What the Law Requires

A. GDPR - Principle:

Personal data shall be adequate, relevant and limited to what is necessary in relation to purposes for which they are processed - Article 5(1)(c)

And storage limitation - kept no longer than necessary.

Every field collected without clear processing purpose creates compounding retention liability - data that should not exist must still be managed, deleted and accounted for in DSARs.

B. India - DPDP Act 2023:

Section 6(1): Consent must be limited to such personal data as is necessary for specified purpose. Law states consent must be free, specific, informed, unconditional, and given with clear affirmative action.

Section 8(7): Data Fiduciary, unless retention required by law, to erase personal data when consent withdrawn or as soon as it is reasonable to assume specified purpose no longer served, and cause Processors to erase data made available to them.

Section 8(8): Deems purpose no longer served in stated inactivity situations. Rule 8 + Third Schedule adds class-specific erasure clocks - e.g., e-commerce, gaming, social media must erase if user does not approach for 3 years.

DPDP Rules Notified Nov 2025 - Compliance deadline May 2027: Failure to purge unnecessary fields = breach of Section 8(7) retention + Section 6 data minimization. Penalty up to Rs 250 crore under Section 33.

RBI also: At database level, this means avoiding unnecessary fields, duplicate copies, along with habit of gathering data for possible future use.

What counts as "unnecessary field"?

• Collecting full DOB when you only need age >18 confirmation - Collect only fields strictly required. If you only need confirmation applicant is over 18, don't store full date of birth.
• Collecting medical history for payroll - If you are running payroll, you need bank details and tax identifiers, not employee's complete medical history.
• Storing fingerprint/iris when basic biometric confirmation suffices
• Keeping Aadhaar, PAN, full address, mother's maiden name in analytical / test datasets
• Log files retaining IP + user agent + device ID beyond 30 days

2. What Constitutes Failure

1. Over-collection at source: Form asks for 30 fields when purpose needs 5
2. No purge schedule: Archive system where it was not possible to determine whether storage was necessary at all or whether data that was no longer required was deleted - exact wording in Deutsche Wohnen case
3. Retention beyond purpose: Keeping tenant data, debtor data, recruitment CVs after statutory period
4. Non-production data: Copying production data with all fields into UAT, analytics lake, ML training without masking/deletion
5. No data minimisation audit: No review of all data collection forms, HR software fields to ensure you only collect data strictly necessary

3. Case Laws - Global Enforcement

A) Lead Case - Deutsche Wohnen SE vs Berlin DPA - Berlin - €14.5 Million (2019) → Re-set to €900k (2026) - CJEU C-807/21

Facts: German real estate company used archive system to store tenants' personal data. System did not have deletion concept - personal data of tenants was stored in electronic archive where it was not possible to determine whether storage was necessary at all or whether data no longer required was deleted.

Held: Violation of Article 5 principles of data minimisation and storage limitation. Berlin Commissioner fined €14.5 million. On appeal, Berlin Regional Court annulled on procedural grounds, but CJEU 5 Dec 2023 confirmed authorities can fine companies directly for violation. Re-imposed €900,000 on 9 June 2026 by LG Berlin.

Ratio in India: Directly applicable to DPDP Section 8(7). Indian Data Protection Board can rely on this.

B) Hamburg DPA vs Debt Collection Company - Nov 2024 - EUR 900,000

• Company retained personal data of debtors even after statutory deletion periods expired - in some cases for up to five years without any legal basis.
• Fine €900k for failure to delete.
• Principle: GDPR sets clear rules on processing and storage based on data minimization and storage limitation.

C) CNIL France vs SAF LOGISTICS - 2023 - €200,000

• Excessive data collection and handling of sensitive employee information during recruitment. Excessive data collection; retention violations; privacy policy gaps. CNIL found GDPR violations and lack of cooperation.

D) CNIL France vs Amazon France Logistique - 2024 - €32 Million

• Excessive monitoring of warehouse employees via scanning systems, collecting unnecessary productivity data, retention of stow time, idle time. Held violation of data minimization - collected more than necessary for stated purpose of logistics management.

E) Croatian DPA vs Gambling Company - 2023 - €2.59 Million

• Excessive fingerprint collection. Under GDPR's data minimization principle, controller must show amount of personal data collected is appropriate, relevant, limited to what is necessary. Findings involved Articles 5,6,9. Fingerprint for entry to gambling hall not necessary.

F) Hungarian NAIH vs UPC - Excessive Data

• Hungarian DPA: It violated principle of data minimisation because it stored and processed data not necessary to achieve goal. Failed to provide legal basis and violated purpose limitation and data minimization.

G) Netherlands AP vs Experian - 2024 - €2.7 Million

• Credit-reporting firm collected and retained more personal data than necessary, and failed to document lawful basis. AP framed decision around data minimisation.

H) Germany - H&M - Hamburg - 2020 - €35.3 Million

• Retailer monitored several hundred employees at Nuremberg site, collecting family issues, religious beliefs, medical data after sick leave. Decision demonstrates risks when organisations fail to comply with data minimisation principle by collecting and retaining excessive data.

I) India - Emerging - DPDP Board Established Nov 13 2025

Board empowered under Section 27 to take action. While no fines yet (grace period till May 2027), RBI and MeitY audits already flagging:

• Banks storing full card number, CVV, OTP in logs
• NBFCs storing video KYC data beyond purpose
• E-commerce retaining Aadhaar image after verification

Under RBI Master Directions, such retention treated as cyber incident.

4. Technical Compliance - How to Purge

DPDP Compliant Checklist:

Data Minimization by Design: Collect only what is necessary - enforced at API and schema level, not policy level. Reject excess data inputs. Separate required and optional fields with clear purpose.

Purpose Mapping: Every field in schema must have: purpose_id, legal basis, retention_days, source. No field without purpose_id.

Purge Triggers - Section 8(7) & 8(8):

• Consent withdrawal = purge within 48 hours
• Purpose fulfilled = auto-archive + purge
• Inactivity - 3 years for notified classes = purge unless law requires
• Employee exit + full and final settlement + 1 year = purge biometric, medical

Retention Schedule: You must establish strict retention schedules and permanently erase personal data from all systems and backups once specific purpose fulfilled.

Action Required: Conduct data minimisation audit. Remove all unnecessary data fields from forms and systems. At database level, avoiding unnecessary fields, duplicate copies.