GDPR first launched the concept of data minimization, which states data controllers should limit collection of personal information to what is relevant and necessary to accomplish a purpose. Some states will soon have privacy laws that include data minimization principles.