Data minimisation in generative AI: from abstract GDPR principle to testable workflow requirement

According to recent guidelines from bodies including the European Data Protection Supervisor (EDPS) and national supervisory authorities, data minimisation in generative AI no longer applies only at the initial data collection but across the whole workflow. Organisations must demonstrate, per phase – from scraping and training to context building and logging – which personal data are strictly necessary and which have been deliberately excluded or anonymised. This requires active application of minimisation in scraping filters, feature selection, context windows and log design.

It is not enough to filter afterwards; minimisation must be technically enforced and visible for audit and accountability. Supervisory authorities thus move the testing point to every step in the chain, meaning organisations must be able to show, per workflow, which data are genuinely needed and where.

What are the new obligations for data minimisation in generative AI?

In October 2025 the European Data Protection Supervisor (EDPS) formally established that data minimisation in generative AI systems is an obligation across the full lifecycle. This means that minimisation is not only relevant at the first data collection, but also at problem definition, model training, testing and production inference. Organisations must demonstrate that they have considered alternatives such as synthetic or anonymised data before deploying personal data. The Kenyan supervisory authority confirms this line and explicitly names minimisation as a design principle for generative AI, with an emphasis on limiting the categories and volumes of personal data at training and inference (EDPS guideline, ODPC Kenya Guidance).

• Minimal data processing per workflow phase.
• Preference for synthetic, aggregated or pseudonymised data.
• Demonstrable trade-offs and documentation per step.

How is the testing point of minimisation shifting within the workflow?

Where data minimisation was previously seen mainly as a duty on the input side, supervisory authorities are now moving the testing point to the whole AI chain. In 2026 the European Data Protection Board (EDPB) underlines that minimisation must already be enforced at web scraping: developers must apply filters before data collection to limit the volume and sensitivity of personal data. During training and context building (as in retrieval-augmented generation) minimisation also becomes a technical design choice, not merely an administrative trade-off (TechTimes on EDPB scraping). This shift also touches the distinction between pseudonymous and anonymous data, as elaborated in Why pseudonymised AI data stays under the GDPR.

1. Scraping: filter in advance by source, type and vulnerable populations.
2. Training: explicit feature selection, exclusion logs, pseudonymisation.
3. Inference: limit context windows and input fields to what is strictly needed.
4. Logging: metadata only where possible, no superfluous content logs.

Which technical measures support demonstrable minimisation?

Technical practical guides, such as those described by SOTA.io, translate the requirements of the GDPR and the EU AI Act into concrete measures within generative AI workflows. Examples include:

• Scraping filters and source selection to exclude unnecessary personal data.
• Feature inventory and exclusion logs at training, so it is clear which fields are deliberately not used.
• Pseudonymisation before the training pipeline, so that sensitive data does not enter the model directly (SOTA.io practical guide).
• Context minimisation in retrieval-augmented generation (RAG), so that only relevant data enters the context window.
• Logging that is limited to necessary metadata and does not store superfluous content.

These measures must be demonstrable in the technical documentation and be included in DPIAs and AI Act technical files. Analyses by Waxell.ai also show that a concrete data minimisation gap arises with AI agents: agents routinely receive more context than the task requires, which means the real enforcement point is the data interfaces and context filters rather than the prompt.

How is data minimisation made visible and verifiable for audits?

According to the latest guidelines, it is not enough to describe minimisation only on paper. Organisations must be able to show, per workflow:

• Which datasets, features and context fields have been excluded or anonymised.
• Which technical controls have been applied at scraping, training and inference.
• How logging has been set up to avoid unnecessary personal data.

Audits call for transparent documentation of these choices. Verification consoles can help by making these minimisation choices visible per workflow, so that professionals and auditors can check whether the ‘as little as possible, just enough’ principle has actually been applied. See also the overview Privacy-sensitive data in AI: from being allowed to demonstrable control.

What is the role of verification tools such as Vera in this context?

Verification tools such as Vera are not a source of new standards, but can help to make minimisation choices visible per workflow. Professionals thus gain insight into scraping filters, feature exclusions, context scopes and log fields. Vera's privacy architecture is designed so that sensitive document values are replaced on EU infrastructure by synthetic, session-only equivalents before AI models are invoked, with only anonymised content sent onward. When a privacy check fails, the document is not sent onward. This supports control and audit, but does not guarantee that every autonomous action can be reconstructed. The professional final judgement remains with the user. See also the Topic hub: AI verification and control mechanisms and the article AI and the GDPR in 2026: why scraping and anonymisation must now demonstrably hold up for more context.

Sources: This article draws on guidelines and analyses from the EDPS, SOTA.io, the Kenyan supervisory authority, TechTimes and Waxell.ai.

← All articles in this topic ← All articles