What it Means
Personal data which is collected and processed by a company must be adequate, relevant and limited for the specified purpose. Should some data be identified as irrelevant and unnecessary to the purpose, a process should be in place to erase or otherwise cease processing it.