ISO 27566 Clause 5.3 - Privacy Characteristics
Minimize personal data in age assurance to only what is needed for age determination; avoid persistent identifiers and delete data after verification
Where this comes from
Provision: Clause 5.3 - Privacy Characteristics
Instrument: ISO/IEC 27566-1:2025
Citation: ISO/IEC 27566-1:2025, Age assurance systems -- Framework, Clause 5.3: Privacy Characteristics
Text version: ISO/IEC 27566-1:2025
Who it applies to
It applies when all of these are true:
- Data categories collected — any answer
- Data retention period — any answer
…unless:
- Age verification method: No age verification
What engineering work it implies
- Data Minimization at CollectionCovers it fully
Implement data minimization principles by collecting only necessary data with purpose limitation.
Sample acceptance criteria Landfall generates for this obligation:
- For each field, document WHY it's necessary (link to feature that uses it)
- Remove fields that have no documented necessity
- Mark truly optional fields as optional in UI (not required)
- Implement automatic deletion when retention period expires
- Don't collect 'nice to have' data - only 'need to have'
Questions people ask
- Does ISO 27566 Clause 5.3 - Privacy Characteristics apply to my service?
- It applies when Data categories collected — any answer; Data retention period — any answer. It does not apply where Age verification method: No age verification.
- From when does this apply?
- ISO 27566 Clause 5.3 - Privacy Characteristics applies from 15 January 2025. Its current status is: in force.
- What engineering work does this imply?
- Typically: Data Minimization at Collection.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.