Core privacy principle that dictates organisations should only collect, process, and store the minimum amount of personal data necessary to achieve a specific, predefined purpose. It requires that data be adequate, relevant, and strictly limited to what is needed.