Purpose Limitation
The principle that personal data collected for one stated purpose may not be used for an unrelated one without a new lawful basis.
Under GDPR this sits alongside minimisation as a core requirement, and it is the one engineers hit unexpectedly — because the technical instinct is that data already held is available for any use, and legally it is not.
The situations where it bites are ordinary product work: using support-ticket data to train a model, using delivery addresses for marketing, using authentication logs for behavioural analytics, or joining two datasets collected under different bases to produce something neither purpose covered.
The architectural consequence is that purpose must be recorded with the data and carried through derived datasets. Without it, nobody can answer "may we use this for that?" and the question is settled by whoever is most confident.
What that looks like in practice: purpose and lawful basis as metadata in the data catalogue, propagated through lineage so a derived table inherits the constraints of its sources; consent state stored and honoured at query time rather than at collection time; and a review step when a new use is proposed for existing data.
The related trap: anonymisation is not a purpose-limitation escape unless it is genuine. Data that can be re-identified in combination with other data you hold remains personal data, and "we pseudonymised it" is a claim requiring testing rather than assertion.