The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
Section 88: The third data protection principle
Data Protection Act 2018 · 2018 c. 12View on legislation.gov.uk
Part 4: Intelligence services processing — CHAPTER 2: Principles
About this text
This legislation text comes from legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. These source and reuse terms cover the legislation text, not Remedy's commentary.
Reuse reviewed 21 August 2026 under Open Government Licence v3.0.