2. Data Minimization & Purpose Limitation

Relevant legal provisions:
This section is based on POPIA Section 10, Section 13(1), Section 13(2), Section 14(1), and Section 15.

Original legal text:
“Personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.” POPIA, Section 10.

“Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party.” POPIA, Section 13(1).

“Steps must be taken in accordance with section 18 to ensure that the data subject is aware of the purpose for which the information is being collected.” POPIA, Section 13(2).

“Records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed…” POPIA, Section 14(1).

“Further processing of personal information must be in accordance or compatible with the purpose for which it was collected.” POPIA, Section 15.

Types of Data Collected

We collect the following categories of personal data:

☐ Name
☐ Contact details
☐ Demographic data
☐ Location data
☐ Voice/audio data
☐ Other: [specify]

Purpose of Collection

Data is used for:

☐ Survey response collection only
☐ Research / statistical analysis
☐ Service improvement
☐ Policy or impact evaluation
☐ AI model training
☐ Other: [specify]

Data Minimization

We ensure that:

☐ Only data necessary for the stated purpose is collected
☐ No excessive or unrelated data is collected

Awareness of Purpose

Users are informed about the purpose of data collection:

☐ Before data collection
☐ At the point of collection
☐ After collection

Use for AI / Further Processing

Data is reused for additional purposes:

☐ No
☐ Yes

If yes, data is used for:

☐ Analytics
☐ AI model training
☐ Internal research
☐ Other: [specify]

Further processing is:

☐ Compatible with the original purpose
☐ Based on new consent or legal basis

Data Retention Period

Data is retained for:

☐ <30 days
☐ 30–90 days
☐ 3–12 months
☐ 1–3 years
☐ Indefinitely
☐ Other: [specify]

☐ Data is not retained longer than necessary

Data Deletion / End of Lifecycle

At the end of retention, data is:

☐ Deleted
☐ Anonymized
☐ Archived under legal obligation
☐ Other: [specify]