GDPR principle requiring personal data be collected for specified, explicit, and legitimate purposes only.
Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes. When collecting data, be clear about why. Don't repurpose data without ensuring compatibility with original purposes or obtaining new consent. Purpose limitation prevents 'function creep' where data collected for one reason gets used for unrelated purposes.
Why It Matters
The DSC Perspective:
Define and document purposes before collecting data. Don't use data for new purposes without checking compatibility. Purpose limitation ensures data subjects know what they're agreeing to.