CLAIM-2026-08-26-10
GDPR Article 25(2) requires the controller to implement measures ensuring that "by default, only personal data which are necessary for each specific purpose of the processing are processed", and states that the obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
Why it matters
Accessibility is named in the text. A scope expressed as a runtime argument is an outcome, not a default, and Article 25(2) is a duty about defaults.
Sources
- privacyregu2016article