Data minimization is enshrined as one of the GDPR's seven core principles (Article 5(1)(c)) and is reflected in comparable form in the CCPA, Brazil's LGPD, and most modern privacy frameworks. The principle is simple: the best way to reduce the risk of a data breach, a compliance violation, or unauthorized data use is not to collect data you don't need in the first place.
In practice, data minimization runs counter to the instinct of many data and marketing teams, which tend to favor collecting as much data as possible on the theory that it may be useful later. This 'collect everything' approach is increasingly untenable both legally (it conflicts with purpose limitation as well as minimization) and operationally. Large, indiscriminate datasets are harder to manage, more expensive to store, and create larger breach surface areas.
For AI, data minimization presents a specific tension: AI models often perform better with more data. The defensible governance position is that models should be trained on the minimum data required to achieve the desired performance, that synthetic or aggregated data should be used where it can substitute for personal data, and that retention of training data should be time-limited and documented.