ASD ISM 2021 Implement and maintain data minimisation practices
What it says
System owners implement and maintain data minimisation practices for each of their systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem owners should limit data collection and storage to what's necessary.
System owners should only collect and keep the data they truly need. This is important because storing unnecessary information makes an organisation more vulnerable to data breaches, which can lead to financial losses and harm to reputation.
Free. Save your status, tasks and notes.
Why it matters
Excessive data retention increases the risk of data breaches, leading to potential financial loss and reputational damage.
How to implement
System owners should make a list of all the data they collect: Identify what information is needed for their operations.
They could consult with team members who use the data to ensure they aren't collecting more than necessary.
Managers should train staff on data minimisation: Organise training sessions where employees learn why and how to collect only essential data.
Use simple examples to show how unnecessary data can expose the organisation to risk.
The IT team should set up a regular data review: Schedule periodic checks to see what data is being stored and used.
Delete or anonymise any information that isn't necessary for business operations.
Procurement officers should evaluate data needs when acquiring new systems: Before purchasing software or services, ensure they align with the principle of data minimisation.
Check with the vendor to ensure their systems don't require excessive data inputs.
HR should update data handling policies: Work with legal advisors to ensure data collection practices comply with privacy laws.
Provide clear guidelines and distribute them to all staff to reinforce a culture of data minimisation.
Keep it running
Regularly review what data is collected and retained, delete data no longer required, and record retention periods. Document and justify any exceptions to minimisation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data inventory list: Request documentation of all types of data the organisation collects.
Look at
The list to ensure it only includes data absolutely necessary for operations.
Good evidence
Is a current, detailed data inventory with justifications for each data type.
- Check 2 of 5What an auditor asks for
Ask for
To see data review schedules: Obtain the timetable for regular data assessments.
Look at
Scheduled dates and evidence of previous reviews.
Good evidence
Schedule includes completed review dates and future review plans.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records: Check documentation of training sessions focused on data minimisation.
Look at
Attendance logs and training content.
Good evidence
Record includes participant names, dates, and summarised training materials.
- Check 4 of 5What an auditor asks for
Ask for
Procurement evaluations: Review the documentation from recent purchases regarding data needs.
Look at
The evaluation criteria used to choose systems.
Good evidence
Shows how data minimisation was considered in procurement decisions.
- Check 5 of 5What an auditor asks for
Ask for
Updated data handling policies: Request the latest version of data management policies.
Look at
Sections that stress the importance of data minimisation.
Good evidence
Policy clearly outlines data collection limits and guidelines for staff.
Mappings
Closest match in ISO/IEC 27001: A.8.10, Secure deletion of information when no longer needed, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.10.
ISM-2021 requires system owners to implement and maintain data minimisation practices for each system, limiting collection and storage to what is necessary. Annex A 8.10 specifically requires secure deletion of information when it is no longer required, which is a key mechanism to reduce retained data volume over time. ISM-2021 is broader because it covers minimising data at collection, processing, and storage decisions, whereas Annex A 8.10 focuses on end-of-life deletion only.
This control partially overlaps A.5.34.
ISM-2021 requires system owners to limit data collection and storage to what is necessary, reducing exposure from excessive retained information. Annex A 5.34 requires meeting privacy and PII protection requirements, which commonly includes data minimisation principles under privacy law and contractual obligations. They overlap on minimising personal information holdings, but Annex A 5.34 is broader in covering legal/regulatory privacy obligations beyond minimisation (e.g. notice, lawful basis, rights handling).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-01.1Design systems with telemetry, least privilege, data protection and minimal attack surfacePartially overlaps
This control partially overlaps IT.PRO-01.1.
IT.PRO-01.1 requires secure system design that protects data, minimises privileges and removes unnecessary functionality; ISM-2021 supports the data protection aim, with system owners implementing and maintaining data minimisation practices for each system.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.