The third GDPR principle, requiring organisations to only collect the personal data that is truly necessary to fulfill each purpose for data processing.