1. Introduction

Data minimization in biomedical research is the legal and ethical principle that researchers should collect, use, retain, and disclose only the personal data that is adequate, relevant, and necessary for a clearly defined research purpose.

It is particularly important in genomics, clinical trials, biobanking, neuroscience, precision medicine, electronic health records, and AI-assisted drug discovery because these activities may involve highly sensitive information, including genetic sequences, medical histories, brain data, reproductive information, and identifiable patient records.

The central legal question is:

How can biomedical researchers obtain enough information to produce scientifically valid results without unnecessarily compromising the privacy, autonomy, and rights of research participants?

Data minimization does not mean eliminating useful research data or always using the smallest possible dataset. It requires a defensible relationship between the research objective and the amount, detail, identifiability, and duration of data processing.

2. Meaning and scope of data minimization

Data minimization is commonly associated with the broader principles of purpose limitation, storage limitation, transparency, security, and accountability.

Its practical application involves five questions:

Collection: Is each category of data genuinely needed for the research question?

Granularity: Can the objective be achieved using less detailed information?

Identifiability: Can direct identifiers or identifying combinations be removed or protected?

Access and disclosure: Does every researcher or collaborator need access to the underlying identifiable records?

Retention: How long must the data be retained, and what happens when that period ends?

For example, a study examining whether a medicine lowers blood pressure may need age, baseline blood pressure, dosage, relevant medical history, and follow-up measurements. It may not need participants' full residential addresses, unrelated genetic profiles, or complete employment histories.

However, an address or genetic variable may become necessary in a particular study—for instance, to investigate geographic exposure or a genetic treatment response. Necessity must therefore be assessed in context rather than assumed from a fixed list of prohibited data.

3. Legal framework governing data minimization

A. European Union: General Data Protection Regulation (GDPR)

The GDPR provides one of the clearest express legal formulations of data minimization.

Article 5(1)(c) requires personal data to be adequate, relevant, and limited to what is necessary for the purposes for which they are processed. Article 5(1)(b) addresses purpose limitation, while Article 5(1)(e) governs storage limitation, subject to applicable exceptions.

Biomedical research also engages the following provisions:

Scientific research is not a blanket exemption from data protection law. Article 89 allows specified derogations under conditions established by EU or national law, but it does not automatically displace the basic principles of lawful processing, necessity, and appropriate safeguards.

Bailii+2

Example: A genomic research team may need whole-genome sequences to identify rare disease variants. Minimization might require pseudonymising the sequences, separating identity keys, restricting access, and withholding unrelated clinical details from analysts—not necessarily reducing the genome to a few genetic markers if that would undermine the research.

B. India: Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection (DPDP) Act, 2023, establishes a framework for processing digital personal data. Its application to biomedical research must be considered alongside its commencement notifications, rules, and other applicable laws.

Section 17(2)(b) provides an exemption for processing necessary for research, archiving, or statistical purposes where the data are not used to take a decision specific to an individual and the prescribed standards are followed. The DPDP Rules, 2025, address the research exemption in Rule 16 and the Second Schedule. These standards include limiting processing to the personal data necessary for the relevant purpose and implementing appropriate technical and organisational measures.

India Code+2

An important qualification is that the research exemption is conditional. It should not be interpreted as unrestricted permission to collect, retain, or share every available patient record.

The Act has a phased commencement framework. As of 4 November 2026, researchers must check which provisions and rules have actually commenced before relying on the exemption for a particular project.

MeitY+1

Other Indian legal considerations include:

Constitutional privacy: K.S. Puttaswamy v. Union of India (2017), recognising privacy as a fundamental right.

Medical consent: The principles governing informed consent and bodily autonomy, which may be relevant where research involves procedures, samples, or secondary uses of clinical material.

Research ethics: Applicable Indian Council of Medical Research (ICMR) ethical guidance, institutional ethics committee requirements, and clinical-trial regulations where relevant.

These sources address related but distinct questions. A study may satisfy a data minimization standard yet still violate informed-consent requirements, research ethics, confidentiality duties, or another applicable law.

C. United Kingdom

Under Article 5(1)(c) of the UK GDPR, personal data must be adequate, relevant, and limited to what is necessary. The Data Protection Act 2018 supplements this framework, including safeguards relevant to research.

The Information Commissioner's Office explains that researchers should first consider whether the project can be conducted without personal data and, where possible, use anonymised or pseudonymised data. Research provisions do not eliminate the need for appropriate safeguards.

ICO

For biomedical institutions, this translates into a practical requirement to justify the data fields collected, the level of identifiability, the people permitted to access the information, and the period for which it is retained.

4. Important case laws and their legal principles

The following cases are relevant to data minimization, privacy, research consent, or the use of biological material. Some concern the principle directly; others provide analogous reasoning rather than a binding biomedical-specific minimization rule.

Case 1: K.S. Puttaswamy v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: The Supreme Court considered whether privacy is constitutionally protected under the Indian Constitution, in litigation concerning the Aadhaar identification system.

Decision: The nine-judge bench recognised privacy as a fundamental right protected by Article 21 and other freedoms in Part III of the Constitution.

Relevance to biomedical research: The judgment supplies a constitutional foundation for protecting sensitive medical and genetic information. Research involving identifiable health records, genomic databases, or brain-computer interface data may intrude upon privacy if it is excessive, insufficiently justified, or inadequately protected.

Legal principle: Intrusions on privacy must satisfy the applicable requirements of legality, legitimate purpose, and proportionality. The precise test depends on the context and the state action or legal framework involved.

Limitation: Puttaswamy did not establish a standalone, detailed data minimization code for every private biomedical researcher. Its constitutional reasoning supports privacy protection but must be applied through the relevant statutory and factual framework.

Case 2: Samira Kohli v. Dr. Prabha Manchanda (2008)

Supreme Court of India · (2008) 2 SCC 1

Facts and issue: The dispute concerned medical treatment performed beyond the scope of the patient's consent, raising questions about informed consent and the limits of a doctor's authority.

Decision: The Supreme Court explained the importance of valid consent to medical treatment and distinguished consent for one procedure from consent for materially different or additional procedures, subject to recognised exceptions.

Relevance to data minimization: The case is not a direct ruling on research databases. However, it illustrates the broader principle that medical authority is not unlimited simply because information or treatment may be beneficial.

In a biomedical research context, consent to treatment should not automatically be treated as consent to every secondary research use of the patient's records, tissue, or genomic data. Whether additional consent is legally required depends on the applicable law, the original consent, the proposed use, and any valid exception.

Legal principle: Consent must be assessed against the actual purpose and scope of the activity. Data minimization complements this principle by limiting collection and use to what the justified purpose requires.

Case 3: Moore v. Regents of the University of California (1990)

Supreme Court of California · 51 Cal. 3d 120, 793 P.2d 479

Facts: John Moore's physician used cells obtained during treatment to develop a commercially valuable cell line without adequately disclosing relevant research and financial interests.

Decision: The court rejected Moore's conversion claim concerning the excised cells but allowed claims relating to the physician's failure to disclose material personal interests, including a potential breach of fiduciary duty and lack of informed consent.

Justia Law

Relevance: Biomedical research may create pressure to retain and reuse biological material and associated data for future commercial or scientific purposes. Moore illustrates why disclosure and consent-related duties cannot simply be displaced by the potential value of research.

Legal principle: The scientific or commercial usefulness of biological material does not remove the need to address relevant disclosure and consent obligations.

Limitation: This was primarily a case about informed consent, fiduciary duty, and ownership claims—not a direct judicial test of data minimization.

Case 4: Mousse v. Commission nationale de l'informatique et des libertés (CNIL), SNCF Connect (2025)

Court of Justice of the European Union · Case C-394/23 · ECLI:EU:C:2025:2

Facts: SNCF Connect required customers purchasing railway tickets online to select a title, such as Mr or Ms. The practice was challenged as unnecessary collection of personal information.

Decision: On 9 January 2025, the Court examined the practice under GDPR data minimization and lawfulness requirements. It held that the relevant legal bases could not justify systematic collection of titles where the requirements of necessity were not met.

EUR-Lex+1

Application to biomedical research: This is a particularly useful modern authority because it illustrates that routine collection is not justified merely because a field is convenient or customary.

A hospital research database should therefore question whether it needs each participant's exact date of birth, sex or gender information, residential address, or other potentially sensitive attributes. If age bands or coded variables are scientifically sufficient, collecting more detailed information may be difficult to justify.

Legal principle: Researchers should be able to explain why each personal-data field is necessary for the research purpose, rather than treating the availability of a field as sufficient justification for collecting it.

Case 5: Schrems v. Meta Platforms Ireland Ltd (2024)

Court of Justice of the European Union · Case C-446/21 · ECLI:EU:C:2024:834

Facts: The dispute concerned the aggregation and use of personal data for targeted advertising, including sensitive information relating to sexual orientation.

Decision: The Court held that Article 5(1)(c) GDPR precludes the unrestricted aggregation, analysis, and processing of all personal data obtained from a user or third parties for targeted advertising, without limits on duration or distinctions based on data type. It also held that a person's public statement about sexual orientation did not, by itself, authorise the processing of other data about that orientation obtained from external sources for personalised advertising.

EUR-Lex+1

Application to biomedical research: The case is relevant to research platforms that combine electronic health records, genomic datasets, wearable-device measurements, and third-party commercial data.

For example, a researcher investigating cardiovascular disease cannot automatically assume that every available social-media record, genetic marker, and location trace should be combined with hospital records. Each data category and the duration of its use must be justified by the project's purpose and legal basis.

Legal principle: Data minimization prohibits indiscriminate, unrestricted processing. Making one piece of sensitive information public does not automatically authorise every further use of related information.

Limitation: The case concerned commercial targeted advertising, not a biomedical research programme. Its direct legal holding must be distinguished from its analogous relevance to research.

5. How data minimization applies across the research lifecycle

Stage 1 — Research design

Define the hypothesis, endpoints, inclusion criteria, and data fields before collecting records. Document why each category is required and whether a less intrusive alternative would work.

Stage 2 — Collection and recruitment

Collect only information justified by the protocol. Avoid copying entire patient records where a defined subset will answer the research question.

Stage 3 — De-identification and access

Remove direct identifiers where feasible, use coded participant IDs, store re-identification keys separately, and provide researchers with only the access their roles require.

Stage 4 — Analysis and sharing

Assess the need for record linkage, external datasets, and onward transfers. Use controlled access, secure research environments, or aggregated results when these can achieve the purpose.

Stage 5 — Retention and disposal

Set a justified retention period, review continuing necessity, and securely delete or irreversibly anonymise data when appropriate. Preserve records where required by law, trial integrity, or a justified research-retention purpose.

6. Special issues in genomic and biomedical research

A. Genomic data and re-identification

Genomic data are unusually difficult to minimise because a sequence may contain information about inherited disease risks, biological relationships, ancestry, and relatives who never participated in the study.

Removing a name is not necessarily enough to make genomic data anonymous. Researchers should assess re-identification risk in light of the data's uniqueness, the availability of external datasets, and the possibility of linkage.

Appropriate measures include:

Using pseudonymised rather than directly identifiable records for routine analysis.

Separating identity keys and restricting access to them.

Providing only the genomic features needed for a particular analysis when full sequences are unnecessary.

Applying controlled-access procedures to sensitive genomic datasets.

Assessing the privacy implications of family-level and cross-dataset inference.

Important distinction: Pseudonymisation is a protective measure, not necessarily anonymisation. If a person can be re-identified using additional information, the data may remain personal data under applicable law.

B. Clinical trials

Clinical trials need enough data to establish safety, efficacy, adverse events, and the reliability of the study results. Minimization must not be applied so aggressively that it undermines participant safety or scientific validity.

For example, adverse-event reporting may require details about symptoms, timing, dosage, concurrent medications, and relevant medical history. These details can be necessary even though they are sensitive.

A defensible protocol should distinguish between:

Data required by the scientific design or safety-monitoring plan.

Data required by applicable clinical-trial or regulatory obligations.

Data useful only for exploratory analyses.

Data collected merely because they are available.

The fourth category deserves particular scrutiny.

C. AI-based drug discovery

Machine-learning research may use large datasets to identify biomarkers, predict disease progression, or discover potential therapeutic targets. A large dataset is not automatically unlawful, but scale alone does not justify processing.

Researchers should document why the selected dataset is appropriate, evaluate whether synthetic, aggregated, or less identifiable data could suffice, restrict access to sensitive records, and assess whether models or outputs could reveal information about participants.

Data minimization also applies to secondary uses. Permission to use data for one project should not be treated as universal authorisation for unrelated model development or commercial sharing.

7. Conflict between data minimization and scientific freedom

One of the most difficult legal questions is whether minimization may prevent researchers from preserving data that could become useful for future discoveries.

The answer is generally no automatic prohibition on future research retention, but no unrestricted right to retain everything either.

Under GDPR Article 5(1)(e), personal data must ordinarily be kept no longer than necessary for the purpose. However, the GDPR contains a specific qualification for longer storage for scientific research purposes, subject to Article 89(1) safeguards and the applicable legal framework. Article 5(1)(b) also addresses further processing for scientific research.

The European Data Protection Board's 2026 scientific-research guidance discusses how organisations should substantiate intended future research uses, evaluate which categories of data are necessary to retain, and periodically review prolonged storage.

European Data Protection Board

Three situations should be distinguished:

The appropriate approach is to retain a scientifically justified dataset, document the reasons for long-term preservation, periodically review necessity, and consider whether identifiable source records can be separated from the research dataset.

8. Legal consequences of non-compliance

A failure to minimise biomedical data can create several types of liability. The consequences depend on the jurisdiction, the legal basis of the claim, the seriousness of the breach, and whether the conduct caused legally recognised harm.

Regulatory enforcement: A data protection authority may investigate excessive collection, incompatible secondary use, inadequate retention practices, or insufficient safeguards.

Compensation claims: Under applicable law, participants may seek remedies where unlawful processing and the relevant requirements for compensation are established.

Research ethics consequences: An ethics committee or research institution may require protocol amendments, suspend research, restrict access, or investigate misconduct.

Contractual and institutional consequences: Data-sharing agreements, grant conditions, confidentiality obligations, and research governance requirements may be breached.

Clinical and commercial consequences: Unnecessary retention or disclosure of identifiable information may damage participant trust, delay research, and undermine the acceptability of a research programme.

A data breach is not required for every possible minimization violation. Excessive collection or processing can itself raise compliance issues, even if the data remain secure.

Conversely, a security breach does not automatically prove that data minimization was violated. The two obligations are related but distinct.

9. Practical compliance checklist for biomedical institutions

The following checklist can be used by universities, hospitals, biotechnology companies, clinical research organisations, and genomic-data repositories.

Research data minimization audit

0 of 12

Define and document each research purpose.

Map the personal and sensitive data collected.

Justify each field against the scientific or regulatory objective.

Assess whether less detailed or less identifiable data would suffice.

Establish the legal basis and any required condition for processing health or genetic data.

Obtain appropriate informed consent where required and explain relevant secondary uses.

Document ethics committee approval and applicable trial authorisations.

Separate identifiers from research data and restrict re-identification.

Set role-based access and rules for data sharing or cross-border transfers.

Specify retention periods and procedures for periodic review.

Record the rationale for future research use and long-term retention.

Review the protocol when research objectives or data sources change.

Reset checklist

This is an operational checklist, not a guarantee of legal compliance. The institution must adapt it to the applicable jurisdiction, type of research, and data involved.

10. Overall legal analysis

Data minimization in biomedical research requires a balance between two legitimate interests: advancing scientific knowledge and protecting individuals from unnecessary intrusion into their private lives.

The key authorities contribute different parts of that analysis:

K.S. Puttaswamy provides the Indian constitutional foundation for privacy.

Samira Kohli demonstrates the importance of the scope and validity of consent in medical contexts.

Moore illustrates the importance of disclosure and consent when biological material is used for research.

Mousse provides a direct judicial application of the GDPR minimization principle to unnecessary data collection.

Schrems v. Meta establishes that indiscriminate aggregation and processing of personal data cannot be justified without restriction merely because the data are available.

The EU cases directly interpret GDPR provisions; the Indian and US cases address related constitutional, consent, fiduciary, or biological-material issues rather than establishing an identical minimization rule.

Conclusion: A lawful biomedical research programme should be able to explain why the information it collects is needed, why the level of detail is appropriate, who requires access, and how long the data must be retained. Scientific value is a legitimate consideration, but it is not a substitute for a lawful basis, appropriate consent where required, necessity, proportionality, and effective safeguards.

Primary sources for further study

EU General Data Protection Regulation — official text.

CJEU, Mousse, Case C-394/23 — judgment.

CJEU, Schrems, Case C-446/21 — judgment.

India Code — Digital Personal Data Protection Act, 2023.

Government of India — DPDP commencement notification.

This is a general comparative legal explanation, not jurisdiction-specific legal advice. For an actual research protocol, the applicable consent documents, ethics approvals, data-protection rules, and trial regulations should be assessed together.