First-party data
First-party data is collected in the direct relationship between an organisation and its audiences. It can come from a purchase, an account, a contact, or participation. Collecting it directly does not exempt you from defining a purpose, a legal basis, a retention period, and appropriate access.
A concrete example
Registrations, purchases, and preferences collected directly through interaction with a brand can enrich customer knowledge, according to defined purposes.
A point to consider
Collecting data directly does not grant the right to use it for any purpose. Verify the information, legal basis, and retention period.
Justify each data point by its use.
For each field, note the decision or service it enables, its source, the person responsible, and its retention period. Delete fields without a defined purpose and prioritize less precise information when it is sufficient. Also, check the quality: identifiers, duplicates, and update dates. A larger database does not compensate for unreliable or unnecessarily collected information.
Reference: CNIL, Minimize the data collected.SourceQuestions to ask your team
- What service would be impossible without this data?
- Is the same information unnecessarily copied across multiple tools?


