how do I fill in the question about data minimization for personal data

Data minimisation is linked to access policy, not encryption

Data minimisation itself is not listed as a separate measure in Article 21(2) NIS2 — those ten measures concern risk management, incident handling, business continuity and access control, not the GDPR principles of data collection. Yet the question often legitimately appears in the same questionnaire, because customers combine their NIS2 and privacy assessments. The supporting evidence that fits here is not a GDPR processing register but the access policy: who may access which data, and is that limited to what is necessary for the role. That aligns with the access policy including management of business assets — if role-based access and the "need to know" principle are included there, that is often sufficient substantiation for a "yes".

If you have no separate GDPR minimisation policy but do have an ISO 27001 certificate, then Annex A is a stronger card than you think: the control measures on access restriction and information classification implicitly cover data minimisation, without you needing to use the term itself. In that case, refer to the company's ISO 27001 certificate and let the system link the answer to that. If you have neither, do not automatically answer "yes" — enter what is factually correct, even if that is "no, still being developed".

Where this comes from: Article 21(2) and Annex A

Article 21(2) NIS2 mentions access control policy and asset management as two of the ten mandatory measures, without using the term data minimisation; ISO/IEC 27001 Annex A elaborates on this further via control measures for access restriction and information classification, and the Cybersecurity Act adopts the NIS2 text verbatim when it enters into force on 15 August 2026.