Data Minimisation
Collecting and retaining only what a stated purpose requires, which reduces both regulatory exposure and breach impact at the same time.
The default instinct in systems design is to keep everything: storage is cheap and a future analysis might want it. Minimisation is the deliberate opposite, and it is the single most effective privacy control because data not held cannot be breached, mis-shared, or subject to an access request.
It applies at four points. Collection — do not ask for a date of birth if an age-over-eighteen boolean serves. Granularity — store a postcode district rather than a full address, an age band rather than a birth date, where the use case permits. Propagation — a downstream system should receive the fields it needs rather than the whole record, which is where most unnecessary copies originate. Retention — delete when the purpose is served rather than when storage runs out.
The organisational obstacle is that the cost of holding data is diffuse and the benefit of holding it is imagined but specific: someone can always describe an analysis that might need it. The counter is to require the purpose to be stated at collection, which converts "we might want it" into a claim someone has to make.
The measurable version is a periodic review of fields collected against fields actually used in any query in the past year. The gap is usually large, and it is the fastest available reduction in exposure.