Purpose Binding
Attaching the reason data was collected to the data itself, so a later use that does not match can be identified rather than assumed permissible.
Data is collected under a stated purpose, and using it for a different one generally requires a fresh basis. The architectural problem is that once data is in a warehouse it is just a table, and the purpose it was collected under is not attached to it — so the question cannot be answered technically and is answered by whoever is asked.
Purpose binding attaches it. The record or dataset carries the purpose and the lawful basis under which it was obtained. Access policy evaluates the requester's declared purpose against it. A dataset collected for order fulfilment does not satisfy a marketing analytics request, and the system can say so rather than relying on someone remembering.
Two hard cases recur. Derived data — an aggregate built from several sources inherits the most restrictive purpose of its inputs unless a transformation removes the constraint, which is a judgement rather than an automatic rule. And secondary use, where a genuinely valuable new analysis is proposed on existing data: the correct answers are a compatible-purpose assessment, a fresh consent, or anonymisation to the point where the regime no longer applies — and the wrong answer, which is common, is to proceed because the data is already there.