Part 3: Law enforcement processing Chapter 2: Principles Section 37: The third data protection principle
The third principle (section 37) requires that personal data to be adequate and relevant and not excessive for the purposes for which it is processed. The term "adequate, relevant and not excessive" was also used (undefined) in the 1998 Act; Commissioner guidance provided that in practice this term meant that controllers should ensure that:
	they hold personal data about an individual that is sufficient for the purpose it is being held for in relation to that individual; and
	they do not hold more information than is needed for that purpose.