Data minimisation
Collecting, keeping and exposing only the personal data needed for a stated purpose, for no longer than needed.
Data minimisation is a GDPR principle (Article 5(1)(c)): data must be adequate, relevant and limited to what is necessary. In engineering terms it means not collecting fields you do not use, truncating or aggregating early, setting retention and deleting on schedule, and limiting which services and people see raw identifiers.
It is the cheapest security control there is: data you do not hold cannot leak, be subpoenaed or need a DSAR response. Design reviews should ask of every new field why it is needed and when it is deleted.
It goes wrong through logs and analytics that quietly capture full request bodies, "we might need it later" retention, and copies in data warehouses that outlive the source system's deletion.