Necessity And Proportionality

What the tests mean in practice

Necessity and proportionality are complementary legal and governance tests. Necessity asks whether a processing activity is genuinely needed to achieve a stated purpose, while proportionality asks whether the scope of collection, use, retention, and control measures are reasonable for the privacy impact involved.

Together, they force organisations to connect purpose, data volume, sensitivity, and safeguards. A process can be useful but still fail necessity if the same outcome can be achieved with less data, fewer recipients, or a narrower method.

How the tests are applied

Necessity is usually the first filter: define the purpose, then test whether each element of processing is essential to that purpose rather than merely convenient. Proportionality then asks whether the chosen design is no broader than needed, including whether the data categories, access patterns, sharing model, and retention period are justified.

In practice, this is why privacy assessments often move from a purpose statement to a more detailed review of data minimisation, access limitation, and retention controls. EU General Data Protection Regulation (GDPR) is a useful reference point because its principles and DPIA expectations reflect the same discipline of limiting processing to what is justified and necessary.

Why the distinction matters

Necessity and proportionality are not the same test. Necessity is about whether the activity should exist at all in its current form; proportionality is about whether its design is appropriately bounded. That distinction matters because an activity may be necessary in principle, yet still become excessive if it collects too much data, retains it too long, or exposes it to more people than required.

The tests also help explain why a technically lawful design can still be poor privacy practice if it ignores context. A small increase in data scope can be disproportionate when the data is sensitive, when individuals would not reasonably expect the processing, or when the control environment is weak.

Common failure modes

The most common mistakes are treating convenience as necessity, assuming “more data is better,” and writing broad purposes that make almost any processing look justified. Another failure mode is focusing only on collection, while ignoring the proportionality of storage, sharing, retention, and downstream reuse.

These failures often show up when teams copy a previous use case, expand an existing dataset for a new purpose, or keep data indefinitely “just in case.” For privacy governance, the real question is whether each additional element still has a defensible purpose and a bounded impact.

Risk and Threat Considerations

When necessity and proportionality are weak, organisations tend to accumulate unnecessary personal data, broader access, and longer retention than they can justify. That increases privacy exposure, enlarges the blast radius of a breach, and makes secondary use or internal misuse harder to control.

Failure mechanism: Over-collection, over-retention, and over-sharing create avoidable exposure because sensitive data exists in more systems, for longer periods, and with more potential recipients than the purpose requires.

Impact: The result can be greater regulatory scrutiny, higher breach impact, weaker user trust, and more difficulty defending the processing decision if challenged.

Practitioner Guidance

What to watch for: Use these tests as a design checkpoint whenever a team proposes new data collection, a new purpose, or a retention extension. If the answer depends on “it might be useful later,” or if the same outcome can be achieved with less data, the case for necessity is weak.

Governance implication: Treat necessity and proportionality as an approval standard, not a wording exercise. The strongest submissions are specific about purpose, clearly limited in scope, and able to explain why each data element, recipient, and retention period is justified.

Related resources from NHI Mgmt Group

• What happens when organisations try to use facial recognition for retail crime prevention without a proportionality assessment?
• How should organisations balance age assurance with privacy and proportionality?
• What is the difference between strict necessity and consent-based cookie use?
• Why does behavioural advertising create compliance risk when teams rely on contractual necessity?