A privacy principle (FIPP) that limits an organization's creation, collection, use, processing, storage, maintaining, disseminating, or disclosing of PII to activities that are directly relevant and necessary to accomplish a legally authorized purpose, and to only maintain PII for as long as is necessary to accomplish the purpose.
Sources:
CNSSI 4009-2022
from
OMB Circular A-130 (2016) - adapted