The pattern of only capturing what the use case actually requires, rather than collecting everything and figuring out the use case later. Both a compliance posture under GDPR's necessity principle and an architectural discipline that limits the blast radius of any data incident. The hardest pattern to implement because it requires deciding what not to collect.
The capability a stack needs to run this pattern, and the vendors that provide it, on Martech Stack Builder.
Collect what the stated purpose needs, decide explicitly before each new field gets added, and treat the customer record as something curated rather than accumulated
Maintain a living inventory of every third-party tracker running on customer-facing surfaces, with the data each takes, the consent context it operates under, and the last-review timestamp that proves the inventory is current