Proportionality

A fundamental principle in data protection requiring that data processing activities be appropriate and necessary in relation to the purposes for which data is processed, without excessive collection or use beyond what's needed. Proportionality means balancing the benefits of processing against privacy impacts and individuals' rights. Organizations must assess whether the intrusiveness of data collection or processing is justified by legitimate purposes and whether less privacy-invasive alternatives exist. For example, collecting extensive personal data for a simple newsletter subscription would be disproportionate, while comprehensive data collection for essential services like banking may be proportionate. Proportionality is closely related to data minimization (GDPR Article 5(1)(c)), requiring that personal data be "adequate, relevant and limited to what is necessary." When assessing proportionality, consider the sensitivity of data, volume collected, processing duration, number of people affected, and potential consequences for individuals. Disproportionate processing violates core data protection principles regardless of having a lawful basis.